Skip to content

Commit 7574923

Browse files
MouhsinElmajdoubyMouhsinElmajdouby
committed
Added AppRole authentication, updated token caching to use the driver cache, and enhanced README with documentation. Included example properties and unit tests for validation.
1 parent b14c54b commit 7574923

13 files changed

+430
-147
lines changed

‎ojdbc-provider-hashicorp/README.md

+50-5
Original file line numberDiff line numberDiff line change
@@ -70,11 +70,6 @@ The provider searches for the following parameters:
7070
</tbody>
7171
</table>
7272

73-
Once authenticated, the `client_token` generated from the `Userpass` method is cached and reused until it expires.
74-
This minimizes API calls to the Vault and enhances performance.
75-
76-
For more information, visit the official documentation: [Userpass Authentication](https://developer.hashicorp.com/vault/api-docs/auth/userpass).
77-
7873
#### Userpass Authentication
7974

8075
The provider searches for the following parameters:
@@ -116,6 +111,56 @@ The provider searches for the following parameters:
116111
</tbody>
117112
</table>
118113

114+
Once authenticated, the `client_token` generated from the `Userpass` method is cached and reused until it expires.
115+
This minimizes API calls to the Vault and enhances performance.
116+
117+
For more information, visit the official documentation: [Userpass Authentication](https://developer.hashicorp.com/vault/api-docs/auth/userpass).
118+
119+
#### AppRole Authentication
120+
121+
The provider searches for the following parameters:
122+
123+
<table>
124+
<thead>
125+
<tr>
126+
<th>Parameter Name</th>
127+
<th>Description</th>
128+
<th>Required</th>
129+
</tr>
130+
</thead>
131+
<tbody>
132+
<tr>
133+
<td><code>VAULT_ADDR</code></td>
134+
<td>The URL of the HashiCorp Vault instance (e.g., <code>https://vault-dedicated.example.com:8200</code>)</td>
135+
<td>Yes</td>
136+
</tr>
137+
<tr>
138+
<td><code>APPROLE_AUTH_PATH</code></td>
139+
<td>The authentication path in the Vault for AppRole (default: <code>approle</code>)</td>
140+
<td>No</td>
141+
</tr>
142+
<tr>
143+
<td><code>VAULT_NAMESPACE</code></td>
144+
<td>The namespace in the Vault (if applicable)</td>
145+
<td>No</td>
146+
</tr>
147+
<tr>
148+
<td><code>ROLE_ID</code></td>
149+
<td>The role ID for the AppRole method</td>
150+
<td>Yes</td>
151+
</tr>
152+
<tr>
153+
<td><code>SECRET_ID</code></td>
154+
<td>The secret ID for the AppRole method</td>
155+
<td>Yes</td>
156+
</tr>
157+
</tbody>
158+
</table>
159+
160+
Once authenticated, the <code>client_token</code> generated from the <strong>AppRole</strong> method is cached and reused until it expires. This minimizes API calls to the Vault and enhances performance.
161+
162+
For more information, visit the official documentation: <a href="https://developer.hashicorp.com/vault/api-docs/auth/approle">AppRole Authentication</a>.
163+
119164
### HCP Vault Secrets
120165

121166
Authentication for the **HCP Vault Secrets** uses the OAuth 2.0 Client Credentials flow.

‎ojdbc-provider-hashicorp/example-test.properties

+13-4
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,25 @@ DEDICATED_VAULT_SECRET_PATH=/v1/admin/secret/data/your-secret-path
9898
KEY=your-secret-key
9999

100100
# Username for Userpass authentication
101-
USERNAME=your-username
101+
VAULT_USERNAME=your-username
102102

103103
# Password for Userpass authentication
104-
PASSWORD=your-password
104+
VAUL_TPASSWORD=your-password
105105

106106
# Optional path to the Userpass authentication mount point in Vault (default: userpass)
107-
AUTH_PATH=userpass
107+
USERPASS_AUTH_PATH=userpass
108108

109109
# Optional namespace for Vault API requests
110-
NAMESPACE=your-namespace
110+
VAULT_NAMESPACE=your-namespace
111+
112+
# Role ID for AppRole authentication
113+
ROLE_ID=your-role-id
114+
115+
# Secret ID for AppRole authentication
116+
SECRET_ID=your-secret-id
117+
118+
# Optional path to the AppRole authentication mount point in Vault (default: approle)
119+
APPROLE_AUTH_PATH=approle
111120

112121
################################################################################
113122
# HCP VAULT SECRETS CONFIGURATION

‎ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultdedicated/authentication/CachedToken.java

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
** Copyright (c) 2025 Oracle and/or its affiliates.
3+
**
4+
** The Universal Permissive License (UPL), Version 1.0
5+
**
6+
** Subject to the condition set forth below, permission is hereby granted to any
7+
** person obtaining a copy of this software, associated documentation and/or data
8+
** (collectively the "Software"), free of charge and under any and all copyright
9+
** rights in the Software, and any and all patent rights owned or freely
10+
** licensable by each licensor hereunder covering either (i) the unmodified
11+
** Software as contributed to or provided by such licensor, or (ii) the Larger
12+
** Works (as defined below), to deal in both
13+
**
14+
** (a) the Software, and
15+
** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
16+
** one is included with the Software (each a "Larger Work" to which the Software
17+
** is contributed by such licensors),
18+
**
19+
** without restriction, including without limitation the rights to copy, create
20+
** derivative works of, display, perform, and distribute the Software and make,
21+
** use, sell, offer for sale, import, export, have made, and have sold the
22+
** Software and the Larger Work(s), and to sublicense the foregoing rights on
23+
** either these or other terms.
24+
**
25+
** This license is subject to the following condition:
26+
** The above copyright notice and either this complete permission notice or at
27+
** a minimum a reference to the UPL must be included in all copies or
28+
** substantial portions of the Software.
29+
**
30+
** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31+
** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32+
** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33+
** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34+
** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35+
** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36+
** SOFTWARE.
37+
*/
38+
39+
package oracle.jdbc.provider.hashicorp.hcpvaultdedicated.authentication;
40+
41+
import oracle.jdbc.AccessToken;
42+
43+
/**
44+
* Represents a cached Vault authentication token with its expiration time.
45+
* <p>
46+
* The cached token contains the {@link AccessToken} and its expiration time.
47+
* It is used to avoid redundant authentication requests by checking token validity
48+
* before re-authenticating.
49+
* </p>
50+
*/
51+
public class CachedToken {
52+
private final AccessToken token;
53+
private final long expirationTime;
54+
55+
public CachedToken(AccessToken token, long leaseDurationInSeconds) {
56+
this.token = token;
57+
this.expirationTime = System.currentTimeMillis() + (leaseDurationInSeconds * 1000);
58+
}
59+
60+
public AccessToken getToken() {
61+
return token;
62+
}
63+
64+
public boolean isValid(long currentTime, long ttlBuffer) {
65+
return currentTime < expirationTime - ttlBuffer;
66+
}
67+
}

‎ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultdedicated/authentication/DedicatedVaultAuthenticationMethod.java

+14-1
Original file line numberDiff line numberDiff line change
@@ -63,5 +63,18 @@ public enum DedicatedVaultAuthenticationMethod {
6363
* Userpass Authentication API</a>.
6464
* </p>
6565
*/
66-
USERPASS
66+
USERPASS,
67+
68+
/**
69+
* Authentication using the AppRole method.
70+
* <p>
71+
* The AppRole method allows authentication using a Role ID and Secret ID.
72+
* This method is designed for machine-to-machine authentication or
73+
* service-based applications. For more information, see the HashiCorp Vault
74+
* documentation:
75+
* <a href="https://developer.hashicorp.com/vault/api-docs/auth/approle">
76+
* AppRole Authentication API</a>.
77+
* </p>
78+
*/
79+
APPROLE
6780
}

‎ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultdedicated/authentication/DedicatedVaultCredentials.java

+1-29
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,12 @@
4444
* HashiCorp Vault.
4545
* </p><p>
4646
* This class encapsulates credentials used for making secure
47-
* requests to the Vault API, supporting both Vault tokens and
48-
* Userpass authentication.
47+
* requests to the Vault API.
4948
* </p>
5049
*/
5150
public final class DedicatedVaultCredentials {
5251

5352
private final String vaultToken;
54-
private final String username;
55-
private final String password;
5653

5754
/**
5855
* Constructs a new {@code DedicatedVaultCredentials} object with
@@ -63,24 +60,7 @@ public final class DedicatedVaultCredentials {
6360
*/
6461
public DedicatedVaultCredentials(String vaultToken) {
6562
this.vaultToken = vaultToken;
66-
this.username = null;
67-
this.password = null;
6863
}
69-
70-
/**
71-
* Constructs a new {@code DedicatedVaultCredentials} object with
72-
* the provided username and password.
73-
*
74-
* @param vaultToken the token used for authentication.
75-
* @param username the username for Userpass authentication.
76-
* @param password the password for Userpass authentication.
77-
*/
78-
public DedicatedVaultCredentials(String vaultToken, String username, String password) {
79-
this.vaultToken = vaultToken;
80-
this.username = username;
81-
this.password = password;
82-
}
83-
8464
/**
8565
* Returns the Vault token used for authentication.
8666
*
@@ -90,12 +70,4 @@ public String getVaultToken() {
9070
return vaultToken;
9171
}
9272

93-
public String getUsername() {
94-
return username;
95-
}
96-
97-
public String getPassword() {
98-
return password;
99-
}
100-
10173
}

0 commit comments

Comments
 (0)