org.springframework.vault.authentication

Class GcpIamAuthentication

java.lang.Object

org.springframework.vault.authentication.GcpJwtAuthenticationSupport

org.springframework.vault.authentication.GcpIamAuthentication

All Implemented Interfaces:

ClientAuthentication

public class GcpIamAuthentication
extends GcpJwtAuthenticationSupport
implements ClientAuthentication

GCP IAM login implementation using GCP IAM service accounts to legitimate its authenticity via JSON Web Token.

This authentication method uses Googles IAM API to obtain a signed token for a specific Credential. Project and service account details are obtained from a GoogleCredential that can be retrieved either from a JSON file or the runtime environment (GAE, GCE).

GcpIamAuthentication uses Google Java API that uses synchronous API.

Since:

2.1

Author:

Mark Paluch, Magnus Jungsbluth

See Also:

GcpIamAuthenticationOptions, HttpTransport, GoogleCredential, GoogleCredentials.getApplicationDefault(), RestOperations, Auth Backend: gcp (IAM), GCP: projects.serviceAccounts.signJwt

Constructor Summary

Constructors

Constructor and Description
GcpIamAuthentication(GcpIamAuthenticationOptions options, RestOperations restOperations) Create a new instance of GcpIamAuthentication given GcpIamAuthenticationOptions and RestOperations.
GcpIamAuthentication(GcpIamAuthenticationOptions options, RestOperations restOperations, com.google.api.client.http.HttpTransport httpTransport) Create a new instance of GcpIamAuthentication given GcpIamAuthenticationOptions, RestOperations and HttpTransport.

Method Summary

Modifier and Type	Method and Description
VaultToken	login() Return a VaultToken.
protected String	signJwt()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

GcpIamAuthentication

public GcpIamAuthentication(GcpIamAuthenticationOptions options,
                            RestOperations restOperations)
                     throws GeneralSecurityException,
                            IOException

Create a new instance of GcpIamAuthentication given GcpIamAuthenticationOptions and RestOperations. This constructor initializes GoogleApacheHttpTransport for Google API usage.

Parameters:

options - must not be null.

restOperations - HTTP client for for Vault login, must not be null.

Throws:

GeneralSecurityException - thrown by GoogleApacheHttpTransport.newTrustedTransport().

IOException - thrown by GoogleApacheHttpTransport.newTrustedTransport().

GcpIamAuthentication

public GcpIamAuthentication(GcpIamAuthenticationOptions options,
                            RestOperations restOperations,
                            com.google.api.client.http.HttpTransport httpTransport)

Create a new instance of GcpIamAuthentication given GcpIamAuthenticationOptions, RestOperations and HttpTransport.

Parameters:

options - must not be null.

restOperations - HTTP client for for Vault login, must not be null.

httpTransport - HTTP client for Google API use, must not be null.

Method Detail

login

public VaultToken login()
                 throws VaultException

Description copied from interface: ClientAuthentication

Return a VaultToken. This method can optionally log into Vault to obtain a token.

Specified by:

login in interface ClientAuthentication

Returns:

a VaultToken.

Throws:

VaultException

signJwt

protected String signJwt()