diff --git a/sdk/core/azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java b/sdk/core/azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java index 548810b0f0b2..f643b4975664 100644 --- a/sdk/core/azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java +++ b/sdk/core/azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java @@ -42,6 +42,9 @@ public BearerTokenAuthenticationPolicy(TokenCredential credential, String... sco @Override public Mono process(HttpPipelineCallContext context, HttpPipelineNextPolicy next) { + if ("http".equals(context.getHttpRequest().getUrl().getProtocol())) { + return Mono.error(new RuntimeException("token credentials require a URL using the HTTPS protocol scheme")); + } return cache.getToken() .flatMap(token -> { context.getHttpRequest().getHeaders().put(AUTHORIZATION_HEADER, BEARER + " " + token.getToken()); diff --git a/sdk/core/azure-core/src/test/java/com/azure/core/credential/CredentialsTests.java b/sdk/core/azure-core/src/test/java/com/azure/core/credential/CredentialsTests.java index 82b4c17b4dca..2a04aa65160f 100644 --- a/sdk/core/azure-core/src/test/java/com/azure/core/credential/CredentialsTests.java +++ b/sdk/core/azure-core/src/test/java/com/azure/core/credential/CredentialsTests.java @@ -13,6 +13,7 @@ import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; import reactor.core.publisher.Mono; +import reactor.test.StepVerifier; import java.net.URL; import java.time.OffsetDateTime; @@ -53,11 +54,32 @@ public void tokenCredentialTest() throws Exception { }; final HttpPipeline pipeline = new HttpPipelineBuilder() - .httpClient(new NoOpHttpClient()) - .policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy) - .build(); + .httpClient(new NoOpHttpClient()) + .policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy) + .build(); - HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("http://localhost")); + HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("https://localhost")); pipeline.send(request).block(); } + + @Test + public void tokenCredentialHttpSchemeTest() throws Exception { + TokenCredential credentials = request -> Mono.just(new AccessToken("this_is_a_token", OffsetDateTime.MAX)); + + HttpPipelinePolicy auditorPolicy = (context, next) -> { + String headerValue = context.getHttpRequest().getHeaders().getValue("Authorization"); + Assertions.assertEquals("Bearer this_is_a_token", headerValue); + return next.process(); + }; + + final HttpPipeline pipeline = new HttpPipelineBuilder() + .httpClient(new NoOpHttpClient()) + .policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy) + .build(); + + HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("http://localhost")); + StepVerifier.create(pipeline.send(request)) + .expectErrorMessage("token credentials require a URL using the HTTPS protocol scheme") + .verify(); + } } diff --git a/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/KeyClientTestBase.java b/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/KeyClientTestBase.java index fd255870d238..89d86b36d0d3 100644 --- a/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/KeyClientTestBase.java +++ b/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/KeyClientTestBase.java @@ -3,31 +3,30 @@ package com.azure.security.keyvault.keys; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.fail; - -import com.azure.core.credential.AccessToken; import com.azure.core.credential.TokenCredential; import com.azure.core.exception.HttpResponseException; import com.azure.core.http.HttpClient; import com.azure.core.http.HttpPipeline; import com.azure.core.http.HttpPipelineBuilder; import com.azure.core.http.netty.NettyAsyncHttpClientBuilder; -import com.azure.core.http.policy.*; -import com.azure.core.http.rest.Response; +import com.azure.core.http.policy.BearerTokenAuthenticationPolicy; +import com.azure.core.http.policy.HttpLogDetailLevel; +import com.azure.core.http.policy.HttpLogOptions; +import com.azure.core.http.policy.HttpLoggingPolicy; +import com.azure.core.http.policy.HttpPipelinePolicy; import com.azure.core.http.policy.HttpPolicyProviders; +import com.azure.core.http.policy.RetryPolicy; +import com.azure.core.http.policy.UserAgentPolicy; +import com.azure.core.http.rest.Response; import com.azure.core.test.TestBase; import com.azure.core.util.Configuration; +import com.azure.identity.DefaultAzureCredentialBuilder; import com.azure.security.keyvault.keys.implementation.AzureKeyVaultConfiguration; import com.azure.security.keyvault.keys.models.CreateKeyOptions; -import com.azure.security.keyvault.keys.models.KeyVaultKey; -import com.azure.identity.DefaultAzureCredentialBuilder; import com.azure.security.keyvault.keys.models.KeyType; +import com.azure.security.keyvault.keys.models.KeyVaultKey; import org.junit.jupiter.api.Test; -import reactor.core.publisher.Mono; -import java.time.Duration; import java.time.OffsetDateTime; import java.time.ZoneOffset; import java.util.ArrayList; @@ -39,6 +38,10 @@ import java.util.function.Consumer; import java.util.function.Function; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.fail; + public abstract class KeyClientTestBase extends TestBase { private static final String KEY_NAME = "javaKeyTemp"; @@ -58,11 +61,9 @@ T clientSetup(Function clientBuilder) { ? "http://localhost:8080" : System.getenv("AZURE_KEYVAULT_ENDPOINT"); - TokenCredential credential; + TokenCredential credential = null; - if (interceptorManager.isPlaybackMode()) { - credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30)))); - } else { + if (!interceptorManager.isPlaybackMode()) { credential = new DefaultAzureCredentialBuilder().build(); } @@ -72,8 +73,9 @@ T clientSetup(Function clientBuilder) { policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), KeyServiceVersion.getLatest())); HttpPolicyProviders.addBeforeRetryPolicies(policies); policies.add(new RetryPolicy()); - policies.add(new BearerTokenAuthenticationPolicy(credential, KeyAsyncClient.KEY_VAULT_SCOPE)); - policies.addAll(policies); + if (credential != null) { + policies.add(new BearerTokenAuthenticationPolicy(credential, KeyAsyncClient.KEY_VAULT_SCOPE)); + } HttpPolicyProviders.addAfterRetryPolicies(policies); policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS))); diff --git a/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/cryptography/CryptographyClientTestBase.java b/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/cryptography/CryptographyClientTestBase.java index 1917a10f96bf..5709682a81ab 100644 --- a/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/cryptography/CryptographyClientTestBase.java +++ b/sdk/keyvault/azure-security-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/cryptography/CryptographyClientTestBase.java @@ -3,25 +3,25 @@ package com.azure.security.keyvault.keys.cryptography; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.fail; - -import com.azure.core.credential.AccessToken; import com.azure.core.credential.TokenCredential; import com.azure.core.exception.HttpResponseException; import com.azure.core.http.HttpClient; import com.azure.core.http.HttpPipeline; import com.azure.core.http.HttpPipelineBuilder; import com.azure.core.http.netty.NettyAsyncHttpClientBuilder; -import com.azure.core.http.policy.*; +import com.azure.core.http.policy.BearerTokenAuthenticationPolicy; +import com.azure.core.http.policy.HttpLogDetailLevel; +import com.azure.core.http.policy.HttpLogOptions; +import com.azure.core.http.policy.HttpLoggingPolicy; +import com.azure.core.http.policy.HttpPipelinePolicy; import com.azure.core.http.policy.HttpPolicyProviders; +import com.azure.core.http.policy.RetryPolicy; +import com.azure.core.http.policy.UserAgentPolicy; import com.azure.core.test.TestBase; import com.azure.core.util.Configuration; import com.azure.identity.DefaultAzureCredentialBuilder; import com.azure.security.keyvault.keys.implementation.AzureKeyVaultConfiguration; import org.junit.jupiter.api.Test; -import reactor.core.publisher.Mono; import java.math.BigInteger; import java.security.InvalidAlgorithmParameterException; @@ -31,13 +31,18 @@ import java.security.spec.KeySpec; import java.security.spec.RSAPrivateCrtKeySpec; import java.security.spec.RSAPublicKeySpec; -import java.time.Duration; -import java.time.OffsetDateTime; -import java.time.ZoneOffset; -import java.util.*; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Objects; import java.util.function.Consumer; import java.util.function.Function; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.fail; + public abstract class CryptographyClientTestBase extends TestBase { @@ -54,7 +59,7 @@ T clientSetup(Function clientBuilder) { ? "http://localhost:8080" : System.getenv("AZURE_KEYVAULT_ENDPOINT"); - TokenCredential credential; + TokenCredential credential = null; HttpClient httpClient; String tenantId = System.getenv("AZURE_TENANT_ID"); @@ -66,9 +71,7 @@ T clientSetup(Function clientBuilder) { assertNotNull(clientSecret); } - if (interceptorManager.isPlaybackMode()) { - credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30)))); - } else { + if (!interceptorManager.isPlaybackMode()) { credential = new DefaultAzureCredentialBuilder().build(); } @@ -77,8 +80,9 @@ T clientSetup(Function clientBuilder) { policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), CryptographyServiceVersion.getLatest())); HttpPolicyProviders.addBeforeRetryPolicies(policies); policies.add(new RetryPolicy()); - policies.add(new BearerTokenAuthenticationPolicy(credential, CryptographyAsyncClient.KEY_VAULT_SCOPE)); - policies.addAll(policies); + if (credential != null) { + policies.add(new BearerTokenAuthenticationPolicy(credential, CryptographyAsyncClient.KEY_VAULT_SCOPE)); + } HttpPolicyProviders.addAfterRetryPolicies(policies); policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS))); diff --git a/sdk/keyvault/azure-security-keyvault-secrets/src/test/java/com/azure/security/keyvault/secrets/SecretClientTestBase.java b/sdk/keyvault/azure-security-keyvault-secrets/src/test/java/com/azure/security/keyvault/secrets/SecretClientTestBase.java index a935f94146a0..7bc64e3579f2 100644 --- a/sdk/keyvault/azure-security-keyvault-secrets/src/test/java/com/azure/security/keyvault/secrets/SecretClientTestBase.java +++ b/sdk/keyvault/azure-security-keyvault-secrets/src/test/java/com/azure/security/keyvault/secrets/SecretClientTestBase.java @@ -3,11 +3,6 @@ package com.azure.security.keyvault.secrets; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.fail; - -import com.azure.core.credential.AccessToken; import com.azure.core.credential.TokenCredential; import com.azure.core.exception.HttpResponseException; import com.azure.core.http.HttpClient; @@ -28,7 +23,8 @@ import com.azure.identity.DefaultAzureCredentialBuilder; import com.azure.security.keyvault.secrets.models.KeyVaultSecret; import com.azure.security.keyvault.secrets.models.SecretProperties; -import java.time.Duration; +import org.junit.jupiter.api.Test; + import java.time.OffsetDateTime; import java.time.ZoneOffset; import java.util.ArrayList; @@ -39,8 +35,10 @@ import java.util.function.BiConsumer; import java.util.function.Consumer; import java.util.function.Function; -import org.junit.jupiter.api.Test; -import reactor.core.publisher.Mono; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.fail; public abstract class SecretClientTestBase extends TestBase { @@ -56,11 +54,9 @@ void beforeTestSetup() { } T clientSetup(Function clientBuilder) { - TokenCredential credential; + TokenCredential credential = null; - if (interceptorManager.isPlaybackMode()) { - credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30)))); - } else { + if (!interceptorManager.isPlaybackMode()) { credential = new DefaultAzureCredentialBuilder().build(); } @@ -70,8 +66,9 @@ T clientSetup(Function clientBuilder) { policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), SecretServiceVersion.getLatest())); HttpPolicyProviders.addBeforeRetryPolicies(policies); policies.add(new RetryPolicy()); - policies.add(new BearerTokenAuthenticationPolicy(credential, SecretAsyncClient.KEY_VAULT_SCOPE)); - policies.addAll(policies); + if (credential != null) { + policies.add(new BearerTokenAuthenticationPolicy(credential, SecretAsyncClient.KEY_VAULT_SCOPE)); + } HttpPolicyProviders.addAfterRetryPolicies(policies); policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS)));