org.springframework.vault.authentication

Class CubbyholeAuthentication

java.lang.Object

org.springframework.vault.authentication.CubbyholeAuthentication

All Implemented Interfaces:

AuthenticationStepsFactory, ClientAuthentication

public class CubbyholeAuthentication
extends Object
implements ClientAuthentication, AuthenticationStepsFactory

Cubbyhole ClientAuthentication implementation.

Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method. An ephemeral token is used to obtain a second, login VaultToken from Vault's Cubbyhole secret backend. The login token is usually longer-lived and used to interact with Vault. The login token can be retrieved either from a wrapped response or from the data section.

Wrapped token response usage

Create a Token

 
  $ vault token-create -wrap-ttl="10m"
  Key                           Value
  ---                           -----
  wrapping_token:               397ccb93-ff6c-b17b-9389-380b01ca2645
  wrapping_token_ttl:           0h10m0s
  wrapping_token_creation_time: 2016-09-18 20:29:48.652957077 +0200 CEST
  wrapped_accessor:             46b6aebb-187f-932a-26d7-4f3d86a68319
 
 

Setup CubbyholeAuthentication

 
  CubbyholeAuthenticationOptions options = CubbyholeAuthenticationOptions
                .builder()
                .initialToken(VaultToken.of("397ccb93-ff6c-b17b-9389-380b01ca2645"))
                .wrapped()
                .build();
  CubbyholeAuthentication authentication = new CubbyholeAuthentication(options, restOperations);
 
 

Stored token response usage

Create a Token

 
  $ vault token-create
  Key                   Value
  ---                   -----
  token                 f9e30681-d46a-cdaf-aaa0-2ae0a9ad0819
  token_accessor        4eee9bd9-81bb-06d6-af01-723c54a72148
  token_duration        0s
  token_renewable       false
  token_policies        [root]

  $ token-create -use-limit=2 -orphan -no-default-policy -policy=none
  Key                   Value
  ---                   -----
  token                 895cb88b-aef4-0e33-ba65-d50007290780
  token_accessor        e84b661c-8aa8-2286-b788-f258f30c8325
  token_duration        0s
  token_renewable       false
  token_policies        [none]

  $ export VAULT_TOKEN=895cb88b-aef4-0e33-ba65-d50007290780
  $ vault write cubbyhole/token token=f9e30681-d46a-cdaf-aaa0-2ae0a9ad0819
 
 

Setup CubbyholeAuthentication

 
  CubbyholeAuthenticationOptions options = CubbyholeAuthenticationOptions
                .builder()
                .initialToken(VaultToken.of("895cb88b-aef4-0e33-ba65-d50007290780"))
                .path("cubbyhole/token")
                .build();
  CubbyholeAuthentication authentication = new CubbyholeAuthentication(options, restOperations);
 
 

Remaining TTL/Renewability

Tokens retrieved from Cubbyhole associated with a non-zero TTL start their TTL at the time of token creation. That time is not necessarily identical with application startup. To compensate for the initial delay, Cubbyhole authentication performs a self lookup for tokens associated with a non-zero TTL to retrieve the remaining TTL. Cubbyhole authentication will not self-lookup wrapped tokens without a TTL because a zero TTL indicates there is no TTL associated.

Non-wrapped tokens do not provide details regarding renewability and TTL by just retrieving the token. A self-lookup will lookup renewability and the remaining TTL.

Author:

Mark Paluch

See Also:

CubbyholeAuthenticationOptions, RestOperations, Auth Backend: Token, Cubbyhole Secret Backend, Response Wrapping

Constructor Summary

Constructors

Constructor and Description
CubbyholeAuthentication(CubbyholeAuthenticationOptions options, RestOperations restOperations) Create a new CubbyholeAuthentication given CubbyholeAuthenticationOptions and RestOperations.

Method Summary

Modifier and Type	Method and Description
static AuthenticationSteps	createAuthenticationSteps(CubbyholeAuthenticationOptions options) Creates a AuthenticationSteps for cubbyhole authentication given CubbyholeAuthenticationOptions.
AuthenticationSteps	getAuthenticationSteps() Get the AuthenticationSteps describing an authentication flow.
VaultToken	login() Return a VaultToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CubbyholeAuthentication

public CubbyholeAuthentication(CubbyholeAuthenticationOptions options,
                               RestOperations restOperations)

Create a new CubbyholeAuthentication given CubbyholeAuthenticationOptions and RestOperations.

Parameters:

options - must not be null.

restOperations - must not be null.

Method Detail

createAuthenticationSteps

public static AuthenticationSteps createAuthenticationSteps(CubbyholeAuthenticationOptions options)

Creates a AuthenticationSteps for cubbyhole authentication given CubbyholeAuthenticationOptions.

Parameters:

options - must not be null.

Returns:

AuthenticationSteps for cubbyhole authentication.

Since:

2.0

login

public VaultToken login()
                 throws VaultException

Description copied from interface: ClientAuthentication

Return a VaultToken. This method can optionally log into Vault to obtain a token.

Specified by:

login in interface ClientAuthentication

Returns:

a VaultToken.

Throws:

VaultException

getAuthenticationSteps

public AuthenticationSteps getAuthenticationSteps()

Description copied from interface: AuthenticationStepsFactory

Get the AuthenticationSteps describing an authentication flow.

Specified by:

getAuthenticationSteps in interface AuthenticationStepsFactory

Returns:

the AuthenticationSteps describing an authentication flow.