Skip to content

Commit 1ef034e

Browse files
NetyyyyNetyyyy
authored
Allow configuration of disableChallengeResourceVerification property of AKV SecretClient (Azure#36628)
* Add disableChallengeResourceVerification
1 parent 789bdc6 commit 1ef034e

File tree

15 files changed

+127
-4
lines changed

15 files changed

+127
-4
lines changed

‎sdk/spring/CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Release History
22

3+
## 4.12.0-beta.1 (Unreleased)
4+
5+
### Spring Cloud Azure Autoconfigure
6+
This section includes changes in `spring-cloud-azure-autoconfigure` module.
7+
8+
#### Bugs Fixed
9+
- Fix the issue that prevented the `disableChallengeResourceVerification` property of the AKV `SecretClient` to be configured [#36628](https://github.com/Azure/azure-sdk-for-java/pull/36628).
10+
311
## 5.5.0 (2023-08-28)
412
- This release is compatible with Spring Boot 3.0.0-3.1.2. (Note: 3.1.x (x>2) should be supported, but they aren't tested with this release.)
513
- This release is compatible with Spring Cloud 2022.0.0-2022.0.4. (Note: 2022.0.x (x>4) should be supported, but they aren't tested with this release.)

‎sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/common/AzureKeyVaultProperties.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ public class AzureKeyVaultProperties extends AbstractAzureHttpConfigurationPrope
1919
*/
2020
private String endpoint;
2121

22+
/**
23+
* Whether to enable the Azure Key Vault challenge resource verification, default: true.
24+
* Calls the disableChallengeResourceVerification method of the Azure Key Vault Client Builder when set to false.
25+
*/
26+
private boolean challengeResourceVerificationEnabled = true;
27+
2228
/**
2329
*
2430
* @return The Azure Key Vault endpoint.
@@ -34,4 +40,21 @@ public String getEndpoint() {
3440
public void setEndpoint(String endpoint) {
3541
this.endpoint = endpoint;
3642
}
43+
44+
/**
45+
*
46+
* @return Whether we should keep the challenge resource verification for the Azure Key Vault Client
47+
*/
48+
public boolean isChallengeResourceVerificationEnabled() {
49+
return challengeResourceVerificationEnabled;
50+
}
51+
52+
/**
53+
*
54+
* @param challengeResourceVerificationEnabled Whether we should keep Azure Key Vault challenge resource verification enabled
55+
*/
56+
public void setChallengeResourceVerificationEnabled(
57+
boolean challengeResourceVerificationEnabled) {
58+
this.challengeResourceVerificationEnabled = challengeResourceVerificationEnabled;
59+
}
3760
}

‎sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/secrets/properties/AzureKeyVaultPropertySourceProperties.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@ public class AzureKeyVaultPropertySourceProperties extends AbstractAzureHttpConf
4343
*/
4444
private Duration refreshInterval = DEFAULT_REFRESH_INTERVAL;
4545

46+
/**
47+
* Whether to enable the Azure Key Vault challenge resource verification, default: true.
48+
* Calls the disableChallengeResourceVerification method of the Azure Key Vault Client Builder when set to false.
49+
*/
50+
private boolean challengeResourceVerificationEnabled = true;
51+
4652
/**
4753
*
4854
* @return The name of this property source.
@@ -138,4 +144,21 @@ public Duration getRefreshInterval() {
138144
public void setRefreshInterval(Duration refreshInterval) {
139145
this.refreshInterval = refreshInterval;
140146
}
147+
148+
/**
149+
*
150+
* @return Whether we should keep Azure Key Vault challenge resource verification enabled
151+
*/
152+
public boolean isChallengeResourceVerificationEnabled() {
153+
return challengeResourceVerificationEnabled;
154+
}
155+
156+
/**
157+
*
158+
* @param challengeResourceVerificationEnabled Whether we should keep Azure Key Vault challenge resource verification enabled
159+
*/
160+
public void setChallengeResourceVerificationEnabled(
161+
boolean challengeResourceVerificationEnabled) {
162+
this.challengeResourceVerificationEnabled = challengeResourceVerificationEnabled;
163+
}
141164
}

‎sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/keyvault/environment/KeyVaultEnvironmentPostProcessor.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ private AzureKeyVaultSecretProperties toAzureKeyVaultSecretProperties(
143143
AzurePropertiesUtils.copyAzureCommonProperties(propertySourceProperties, secretProperties);
144144
secretProperties.setEndpoint(propertySourceProperties.getEndpoint());
145145
secretProperties.setServiceVersion(propertySourceProperties.getServiceVersion());
146+
secretProperties.setChallengeResourceVerificationEnabled(propertySourceProperties.isChallengeResourceVerificationEnabled());
146147
return secretProperties;
147148
}
148149

@@ -197,6 +198,7 @@ private AzureKeyVaultPropertySourceProperties buildMergedProperties(
197198
mergedProperties.setCaseSensitive(propertySourceProperties.isCaseSensitive());
198199
mergedProperties.setSecretKeys(propertySourceProperties.getSecretKeys());
199200
mergedProperties.setRefreshInterval(propertySourceProperties.getRefreshInterval());
201+
mergedProperties.setChallengeResourceVerificationEnabled(propertySourceProperties.isChallengeResourceVerificationEnabled());
200202
return mergedProperties;
201203
}
202204

‎sdk/spring/spring-cloud-azure-autoconfigure/src/main/resources/META-INF/additional-spring-configuration-metadata.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1532,6 +1532,13 @@
15321532
"description": "Secret service version used when making API requests.",
15331533
"sourceType": "com.azure.spring.cloud.autoconfigure.implementation.keyvault.secrets.properties.AzureKeyVaultPropertySourceProperties"
15341534
},
1535+
{
1536+
"name": "spring.cloud.azure.keyvault.secret.property-sources[0].challenge-resource-verification-enabled",
1537+
"type": "java.lang.Boolean",
1538+
"description": "Whether to enable the Azure Key Vault challenge resource verification, default: true. Calls the disableChallengeResourceVerification method of the Azure Key Vault Client Builder when set to false.",
1539+
"sourceType": "com.azure.spring.cloud.autoconfigure.implementation.keyvault.secrets.properties.AzureKeyVaultPropertySourceProperties",
1540+
"defaultValue": true
1541+
},
15351542
{
15361543
"name": "spring.datasource.azure.credential.client-id",
15371544
"type": "java.lang.String",

‎sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/keyvault/certificates/AzureKeyVaultCertificateAutoConfigurationTests.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222

2323
import static org.assertj.core.api.Assertions.assertThat;
2424
import static org.junit.jupiter.api.Assertions.assertEquals;
25+
import static org.junit.jupiter.api.Assertions.assertFalse;
2526

2627
class AzureKeyVaultCertificateAutoConfigurationTests extends AbstractAzureServiceConfigurationTests<
2728
CertificateClientBuilderFactory, AzureKeyVaultCertificateProperties> {
@@ -139,13 +140,15 @@ void configurationPropertiesShouldBind() {
139140
this.contextRunner
140141
.withPropertyValues(
141142
"spring.cloud.azure.keyvault.certificate.endpoint=" + endpoint,
142-
"spring.cloud.azure.keyvault.certificate.service-version=V7_2"
143+
"spring.cloud.azure.keyvault.certificate.service-version=V7_2",
144+
"spring.cloud.azure.keyvault.certificate.challenge-resource-verification-enabled=false"
143145
)
144146
.run(context -> {
145147
assertThat(context).hasSingleBean(AzureKeyVaultCertificateProperties.class);
146148
AzureKeyVaultCertificateProperties properties = context.getBean(AzureKeyVaultCertificateProperties.class);
147149
assertEquals(endpoint, properties.getEndpoint());
148150
assertEquals(CertificateServiceVersion.V7_2, properties.getServiceVersion());
151+
assertFalse(properties.isChallengeResourceVerificationEnabled());
149152
});
150153
}
151154

‎sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/keyvault/environment/KeyVaultEnvironmentPostProcessorTests.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,31 @@ void specificPropertiesHasHigherPriorityThanGlobalPropertiesTest() {
275275
assertEquals(specificMaxRetries, properties.getRetry().getFixed().getMaxRetries());
276276
}
277277

278+
@Test
279+
void challengeResourceVerificationEnabledCanBeSetAsFalseTest() {
280+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-source-enabled", "true");
281+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].challenge-resource-verification-enabled", "false");
282+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].enabled", "true");
283+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].name", NAME_0);
284+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].endpoint", ENDPOINT_0);
285+
AzureKeyVaultSecretProperties secretProperties = processor.loadProperties(environment);
286+
AzureKeyVaultPropertySourceProperties properties = secretProperties.getPropertySources().get(0);
287+
assertTrue(secretProperties.isChallengeResourceVerificationEnabled());
288+
assertFalse(properties.isChallengeResourceVerificationEnabled());
289+
}
290+
291+
@Test
292+
void challengeResourceVerificationEnabledIsSetByDefaultTest() {
293+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-source-enabled", "true");
294+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].enabled", "true");
295+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].name", NAME_0);
296+
environment.setProperty("spring.cloud.azure.keyvault.secret.property-sources[0].endpoint", ENDPOINT_0);
297+
AzureKeyVaultSecretProperties secretProperties = processor.loadProperties(environment);
298+
AzureKeyVaultPropertySourceProperties properties = secretProperties.getPropertySources().get(0);
299+
assertTrue(secretProperties.isChallengeResourceVerificationEnabled());
300+
assertTrue(properties.isChallengeResourceVerificationEnabled());
301+
}
302+
278303
@Disabled("Disable it to unblock Azure Dev Ops pipeline: https://dev.azure.com/azure-sdk/public/_build/results?buildId=1434354&view=logs&j=c1fb1ddd-7688-52ac-4c5f-1467e51181f3")
279304
@Test
280305
void buildKeyVaultPropertySourceWithExceptionTest() {

‎sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/keyvault/secrets/AzureKeyVaultSecretAutoConfigurationTests.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ void configurationPropertiesShouldBind() {
145145
.withPropertyValues(
146146
"spring.cloud.azure.keyvault.secret.endpoint=" + endpoint,
147147
"spring.cloud.azure.keyvault.secret.service-version=V7_2",
148+
"spring.cloud.azure.keyvault.secret.challenge-resource-verification-enabled=false",
148149

149150
"spring.cloud.azure.keyvault.secret.property-source-enabled=false",
150151
"spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=" + endpoint + "-1",
@@ -161,6 +162,7 @@ void configurationPropertiesShouldBind() {
161162
assertEquals(endpoint, properties.getEndpoint());
162163
assertFalse(properties.isPropertySourceEnabled());
163164
assertEquals(SecretServiceVersion.V7_2, properties.getServiceVersion());
165+
assertFalse(properties.isChallengeResourceVerificationEnabled());
164166

165167
AzureKeyVaultPropertySourceProperties propertySourceProperties = properties.getPropertySources().get(0);
166168
assertEquals(endpoint + "-1", propertySourceProperties.getEndpoint());

‎sdk/spring/spring-cloud-azure-service/src/main/java/com/azure/spring/cloud/service/implementation/keyvault/KeyVaultProperties.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@ public interface KeyVaultProperties extends AzureProperties, RetryOptionsProvide
1313

1414
String getEndpoint();
1515

16+
boolean isChallengeResourceVerificationEnabled();
1617
}

‎sdk/spring/spring-cloud-azure-service/src/main/java/com/azure/spring/cloud/service/implementation/keyvault/certificates/CertificateClientBuilderFactory.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ protected void configureService(CertificateClientBuilder builder) {
8888
PropertyMapper map = new PropertyMapper();
8989
map.from(certificateClientProperties.getEndpoint()).to(builder::vaultUrl);
9090
map.from(certificateClientProperties.getServiceVersion()).to(builder::serviceVersion);
91+
map.from(certificateClientProperties.isChallengeResourceVerificationEnabled())
92+
.whenFalse().to(enabled -> builder.disableChallengeResourceVerification());
9193
}
9294

9395
@Override

0 commit comments

Comments
 (0)