org.keycloak.vault

Class AbstractVaultProvider

java.lang.Object

org.keycloak.vault.AbstractVaultProvider

All Implemented Interfaces:

Provider, VaultProvider

Direct Known Subclasses:

FilesPlainTextVaultProvider

public abstract class AbstractVaultProvider
extends Object
implements VaultProvider

Abstract class that is meant to be extended by implementations of VaultProvider that want to have support for key resolvers.

This class implements the obtainSecret(String) method by iterating through the configured resolvers in order and, using the final key name provided by each resolver, calls the obtainSecretInternal(String) method that must be implemented by sub-classes. If obtainSecretInternal(String) returns a non-empty secret, it is immediately returned; otherwise the implementation tries again using the next configured resolver until a non-empty secret is obtained or all resolvers have been tried, in which case an empty VaultRawSecret is returned.

Concrete implementations must, in addition to implementing the obtainSecretInternal(String) method, ensure that each constructor calls the AbstractVaultProvider(String, List) constructor from this class so that the realm and list of key resolvers are properly initialized.

Author:

Stefan Guilhen

Field Summary

Fields

Modifier and Type	Field and Description
protected String	realm
protected List<VaultKeyResolver>	resolvers

Constructor Summary

Constructors

Constructor and Description
AbstractVaultProvider(String realm, List<VaultKeyResolver> configuredResolvers) Creates an instance of AbstractVaultProvider with the specified realm and list of key resolvers.

Method Summary

Modifier and Type	Method and Description
VaultRawSecret	obtainSecret(String vaultSecretId) Retrieves a secret from vault.
protected abstract VaultRawSecret	obtainSecretInternal(String vaultKey) Subclasses of AbstractVaultProvider must implement this method.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.provider.Provider

close

Field Detail

realm

protected final String realm

resolvers

protected final List<VaultKeyResolver> resolvers

Constructor Detail

AbstractVaultProvider

public AbstractVaultProvider(String realm,
                             List<VaultKeyResolver> configuredResolvers)

Creates an instance of AbstractVaultProvider with the specified realm and list of key resolvers.

Parameters:

realm - the name of the keycloak realm.

configuredResolvers - a List containing the configured key resolvers.

Method Detail

obtainSecret

public VaultRawSecret obtainSecret(String vaultSecretId)

Description copied from interface: VaultProvider

Retrieves a secret from vault. The implementation should respect at least the realm ID to separate the secrets within the vault. If the secret is retrieved successfully, it is returned; otherwise this method results into an empty VaultRawSecret.get(). This method is intended to be used within a try-with-resources block so that the secret is destroyed immediately after use. Note that it is responsibility of the implementor to provide a way to destroy the secret in the returned VaultRawSecret.close() method.

Specified by:

obtainSecret in interface VaultProvider

Parameters:

vaultSecretId - Identifier of the secret. It corresponds to the value entered by user in the respective configuration, which in turn is obtained from the vault when storing the secret.

Returns:

Always a non-null value with the raw secret. Within the returned value, the secret or null is stored in the VaultRawSecret.get() return value if the secret was successfully resolved, or an empty Optional if the secret has not been found in the vault.

obtainSecretInternal

protected abstract VaultRawSecret obtainSecretInternal(String vaultKey)

Subclasses of AbstractVaultProvider must implement this method. It is meant to be implemented in the same way as the obtainSecret(String) method from the VaultProvider interface, but the specified vault key must be used as is - i.e. implementations should refrain from processing the key again as the format was already defined by one of the configured key resolvers.

Parameters:

vaultKey - a String representing the name of the entry that is being fetched from the vault.

Returns:

a VaultRawSecret representing the obtained secret. It can be a empty secret if no secret could be obtained using the specified vault key.