Skip to content

Commit 73c46a7

Browse files
Merge pull request #164 from mrunesson/feat-jwt-and-kubernetes
Support for auth within Kubernetes and generic JWT
2 parents 34c1d44 + 3ee0ce5 commit 73c46a7

File tree

1 file changed

+49
-4
lines changed
  • src/main/java/com/bettercloud/vault/api

1 file changed

+49
-4
lines changed

src/main/java/com/bettercloud/vault/api/Auth.java

Lines changed: 49 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -879,31 +879,32 @@ public AuthResponse loginByGithub(final String githubToken, final String githubA
879879
}
880880

881881
/**
882-
* <p>Basic login operation to authenticate to an GCP backend. Example usage:</p>
882+
* <p>Basic login operation to authenticate to an JWT backend. Example usage:</p>
883883
*
884884
* <blockquote>
885885
* <pre>{@code
886-
* final AuthResponse response = vault.auth().loginByGCP("dev", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
886+
* final AuthResponse response = vault.auth().loginByJwt("kubernetes", "dev", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
887887
*
888888
* final String token = response.getAuthClientToken();
889889
* }</pre>
890890
* </blockquote>
891891
*
892+
* @param provider Provider of JWT token.
892893
* @param role The gcp role used for authentication
893894
* @param jwt The JWT token for the role
894895
* @return The auth token, with additional response metadata
895896
* @throws VaultException If any error occurs, or unexpected response received from Vault
896897
*/
897898
// TODO: Needs integration test coverage if possible
898-
public AuthResponse loginByGCP(final String role, final String jwt) throws VaultException {
899+
public AuthResponse loginByJwt(final String provider, final String role, final String jwt) throws VaultException {
899900
int retryCount = 0;
900901

901902
while (true) {
902903
try {
903904
// HTTP request to Vault
904905
final String requestJson = Json.object().add("role", role).add("jwt", jwt).toString();
905906
final RestResponse restResponse = new Rest()
906-
.url(config.getAddress() + "/v1/auth/gcp/login")
907+
.url(config.getAddress() + "/v1/auth/" + provider + "/login")
907908
.optionalHeader("X-Vault-Namespace", this.nameSpace)
908909
.body(requestJson.getBytes(StandardCharsets.UTF_8))
909910
.connectTimeoutSeconds(config.getOpenTimeout())
@@ -941,6 +942,50 @@ public AuthResponse loginByGCP(final String role, final String jwt) throws Vault
941942
}
942943
}
943944

945+
946+
/**
947+
* <p>Basic login operation to authenticate to an GCP backend. Example usage:</p>
948+
*
949+
* <blockquote>
950+
* <pre>{@code
951+
* final AuthResponse response = vault.auth().loginByGCP("dev", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
952+
*
953+
* final String token = response.getAuthClientToken();
954+
* }</pre>
955+
* </blockquote>
956+
*
957+
* @param role The gcp role used for authentication
958+
* @param jwt The JWT token for the role
959+
* @return The auth token, with additional response metadata
960+
* @throws VaultException If any error occurs, or unexpected response received from Vault
961+
*/
962+
public AuthResponse loginByGCP(final String role, final String jwt) throws VaultException {
963+
return loginByJwt("gcp", role, jwt);
964+
}
965+
966+
967+
/**
968+
* Basic login operation to authenticate to an kubernetes backend. Example usage:
969+
*
970+
* <blockquote>
971+
*
972+
* <pre>{@code
973+
* final AuthResponse response =
974+
* vault.auth().loginByKubernetes("dev", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
975+
*
976+
* final String token = response.getAuthClientToken();
977+
* }</pre>
978+
* </blockquote>
979+
*
980+
* @param role The kubernetes role used for authentication
981+
* @param jwt The JWT token for the role, typically read from /var/run/secrets/kubernetes.io/serviceaccount/token
982+
* @return The auth token, with additional response metadata
983+
* @throws VaultException If any error occurs, or unexpected response received from Vault
984+
*/
985+
public AuthResponse loginByKubernetes(final String role, final String jwt) throws VaultException {
986+
return loginByJwt("kubernetes", role, jwt);
987+
}
988+
944989
/**
945990
* <p>Basic login operation to authenticate using Vault's TLS Certificate auth backend. Example usage:</p>
946991
*

0 commit comments

Comments
 (0)