Skip to content

Ensure HTTPS is used when authenticating with tokens #6543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jianghaolu merged 4 commits into from
Nov 26, 2019
Merged

Ensure HTTPS is used when authenticating with tokens #6543

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6e1cbf3
ensure HTTPS is used when authenticating with tokens
jianghaolu Nov 25, 2019
d7353fa
Fix credential tests
jianghaolu Nov 25, 2019
c74644a
Checkstyle
jianghaolu Nov 25, 2019
e5361f4
Avoid dummy credential in playback tests
jianghaolu Nov 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .../azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,9 @@ public BearerTokenAuthenticationPolicy(TokenCredential credential, String... sco

@Override
public Mono<HttpResponse> process(HttpPipelineCallContext context, HttpPipelineNextPolicy next) {
if ("http".equals(context.getHttpRequest().getUrl().getProtocol())) {
return Mono.error(new RuntimeException("token credentials require a URL using the HTTPS protocol scheme"));
}
return cache.getToken()
.flatMap(token -> {
context.getHttpRequest().getHeaders().put(AUTHORIZATION_HEADER, BEARER + " " + token.getToken());
Expand Down
30 changes: 26 additions & 4 deletions sdk/core/azure-core/src/test/java/com/azure/core/credential/CredentialsTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;
import reactor.test.StepVerifier;

import java.net.URL;
import java.time.OffsetDateTime;
Expand Down Expand Up @@ -53,11 +54,32 @@ public void tokenCredentialTest() throws Exception {
};

final HttpPipeline pipeline = new HttpPipelineBuilder()
.httpClient(new NoOpHttpClient())
.policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy)
.build();
.httpClient(new NoOpHttpClient())
.policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy)
.build();

HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("http://localhost"));
HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("https://localhost"));
pipeline.send(request).block();
}

@Test
public void tokenCredentialHttpSchemeTest() throws Exception {
TokenCredential credentials = request -> Mono.just(new AccessToken("this_is_a_token", OffsetDateTime.MAX));

HttpPipelinePolicy auditorPolicy = (context, next) -> {
String headerValue = context.getHttpRequest().getHeaders().getValue("Authorization");
Assertions.assertEquals("Bearer this_is_a_token", headerValue);
return next.process();
};

final HttpPipeline pipeline = new HttpPipelineBuilder()
.httpClient(new NoOpHttpClient())
.policies(new BearerTokenAuthenticationPolicy(credentials, "scope./default"), auditorPolicy)
.build();

HttpRequest request = new HttpRequest(HttpMethod.GET, new URL("http://localhost"));
StepVerifier.create(pipeline.send(request))
.expectErrorMessage("token credentials require a URL using the HTTPS protocol scheme")
.verify();
}
}
36 changes: 19 additions & 17 deletions ...urity-keyvault-keys/src/test/java/com/azure/security/keyvault/keys/KeyClientTestBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,31 +3,30 @@

package com.azure.security.keyvault.keys;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;

import com.azure.core.credential.AccessToken;
import com.azure.core.credential.TokenCredential;
import com.azure.core.exception.HttpResponseException;
import com.azure.core.http.HttpClient;
import com.azure.core.http.HttpPipeline;
import com.azure.core.http.HttpPipelineBuilder;
import com.azure.core.http.netty.NettyAsyncHttpClientBuilder;
import com.azure.core.http.policy.*;
import com.azure.core.http.rest.Response;
import com.azure.core.http.policy.BearerTokenAuthenticationPolicy;
import com.azure.core.http.policy.HttpLogDetailLevel;
import com.azure.core.http.policy.HttpLogOptions;
import com.azure.core.http.policy.HttpLoggingPolicy;
import com.azure.core.http.policy.HttpPipelinePolicy;
import com.azure.core.http.policy.HttpPolicyProviders;
import com.azure.core.http.policy.RetryPolicy;
import com.azure.core.http.policy.UserAgentPolicy;
import com.azure.core.http.rest.Response;
import com.azure.core.test.TestBase;
import com.azure.core.util.Configuration;
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.keys.implementation.AzureKeyVaultConfiguration;
import com.azure.security.keyvault.keys.models.CreateKeyOptions;
import com.azure.security.keyvault.keys.models.KeyVaultKey;
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.keys.models.KeyType;
import com.azure.security.keyvault.keys.models.KeyVaultKey;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;

import java.time.Duration;
import java.time.OffsetDateTime;
import java.time.ZoneOffset;
import java.util.ArrayList;
Expand All @@ -39,6 +38,10 @@
import java.util.function.Consumer;
import java.util.function.Function;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;

public abstract class KeyClientTestBase extends TestBase {

private static final String KEY_NAME = "javaKeyTemp";
Expand All @@ -58,11 +61,9 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
? "http://localhost:8080"
: System.getenv("AZURE_KEYVAULT_ENDPOINT");

TokenCredential credential;
TokenCredential credential = null;

if (interceptorManager.isPlaybackMode()) {
credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30))));
} else {
if (!interceptorManager.isPlaybackMode()) {
credential = new DefaultAzureCredentialBuilder().build();
}

Expand All @@ -72,8 +73,9 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), KeyServiceVersion.getLatest()));
HttpPolicyProviders.addBeforeRetryPolicies(policies);
policies.add(new RetryPolicy());
policies.add(new BearerTokenAuthenticationPolicy(credential, KeyAsyncClient.KEY_VAULT_SCOPE));
policies.addAll(policies);
if (credential != null) {
policies.add(new BearerTokenAuthenticationPolicy(credential, KeyAsyncClient.KEY_VAULT_SCOPE));
}
HttpPolicyProviders.addAfterRetryPolicies(policies);
policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS)));

Expand Down
38 changes: 21 additions & 17 deletions ...c/test/java/com/azure/security/keyvault/keys/cryptography/CryptographyClientTestBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,25 @@

package com.azure.security.keyvault.keys.cryptography;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;

import com.azure.core.credential.AccessToken;
import com.azure.core.credential.TokenCredential;
import com.azure.core.exception.HttpResponseException;
import com.azure.core.http.HttpClient;
import com.azure.core.http.HttpPipeline;
import com.azure.core.http.HttpPipelineBuilder;
import com.azure.core.http.netty.NettyAsyncHttpClientBuilder;
import com.azure.core.http.policy.*;
import com.azure.core.http.policy.BearerTokenAuthenticationPolicy;
import com.azure.core.http.policy.HttpLogDetailLevel;
import com.azure.core.http.policy.HttpLogOptions;
import com.azure.core.http.policy.HttpLoggingPolicy;
import com.azure.core.http.policy.HttpPipelinePolicy;
import com.azure.core.http.policy.HttpPolicyProviders;
import com.azure.core.http.policy.RetryPolicy;
import com.azure.core.http.policy.UserAgentPolicy;
import com.azure.core.test.TestBase;
import com.azure.core.util.Configuration;
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.keys.implementation.AzureKeyVaultConfiguration;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;

import java.math.BigInteger;
import java.security.InvalidAlgorithmParameterException;
Expand All @@ -31,13 +31,18 @@
import java.security.spec.KeySpec;
import java.security.spec.RSAPrivateCrtKeySpec;
import java.security.spec.RSAPublicKeySpec;
import java.time.Duration;
import java.time.OffsetDateTime;
import java.time.ZoneOffset;
import java.util.*;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.function.Consumer;
import java.util.function.Function;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;


public abstract class CryptographyClientTestBase extends TestBase {

Expand All @@ -54,7 +59,7 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
? "http://localhost:8080"
: System.getenv("AZURE_KEYVAULT_ENDPOINT");

TokenCredential credential;
TokenCredential credential = null;
HttpClient httpClient;

String tenantId = System.getenv("AZURE_TENANT_ID");
Expand All @@ -66,9 +71,7 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
assertNotNull(clientSecret);
}

if (interceptorManager.isPlaybackMode()) {
credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30))));
} else {
if (!interceptorManager.isPlaybackMode()) {
credential = new DefaultAzureCredentialBuilder().build();
}

Expand All @@ -77,8 +80,9 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), CryptographyServiceVersion.getLatest()));
HttpPolicyProviders.addBeforeRetryPolicies(policies);
policies.add(new RetryPolicy());
policies.add(new BearerTokenAuthenticationPolicy(credential, CryptographyAsyncClient.KEY_VAULT_SCOPE));
policies.addAll(policies);
if (credential != null) {
policies.add(new BearerTokenAuthenticationPolicy(credential, CryptographyAsyncClient.KEY_VAULT_SCOPE));
}
HttpPolicyProviders.addAfterRetryPolicies(policies);
policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS)));

Expand Down
25 changes: 11 additions & 14 deletions ...vault-secrets/src/test/java/com/azure/security/keyvault/secrets/SecretClientTestBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,6 @@

package com.azure.security.keyvault.secrets;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;

import com.azure.core.credential.AccessToken;
import com.azure.core.credential.TokenCredential;
import com.azure.core.exception.HttpResponseException;
import com.azure.core.http.HttpClient;
Expand All @@ -28,7 +23,8 @@
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
import com.azure.security.keyvault.secrets.models.SecretProperties;
import java.time.Duration;
import org.junit.jupiter.api.Test;

import java.time.OffsetDateTime;
import java.time.ZoneOffset;
import java.util.ArrayList;
Expand All @@ -39,8 +35,10 @@
import java.util.function.BiConsumer;
import java.util.function.Consumer;
import java.util.function.Function;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.fail;

public abstract class SecretClientTestBase extends TestBase {

Expand All @@ -56,11 +54,9 @@ void beforeTestSetup() {
}

<T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
TokenCredential credential;
TokenCredential credential = null;

if (interceptorManager.isPlaybackMode()) {
credential = resource -> Mono.just(new AccessToken("Some fake token", OffsetDateTime.now(ZoneOffset.UTC).plus(Duration.ofMinutes(30))));
} else {
if (!interceptorManager.isPlaybackMode()) {
credential = new DefaultAzureCredentialBuilder().build();
}

Expand All @@ -70,8 +66,9 @@ <T> T clientSetup(Function<HttpPipeline, T> clientBuilder) {
policies.add(new UserAgentPolicy(AzureKeyVaultConfiguration.SDK_NAME, AzureKeyVaultConfiguration.SDK_VERSION, Configuration.getGlobalConfiguration().clone(), SecretServiceVersion.getLatest()));
HttpPolicyProviders.addBeforeRetryPolicies(policies);
policies.add(new RetryPolicy());
policies.add(new BearerTokenAuthenticationPolicy(credential, SecretAsyncClient.KEY_VAULT_SCOPE));
policies.addAll(policies);
if (credential != null) {
policies.add(new BearerTokenAuthenticationPolicy(credential, SecretAsyncClient.KEY_VAULT_SCOPE));
}
HttpPolicyProviders.addAfterRetryPolicies(policies);
policies.add(new HttpLoggingPolicy(new HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS)));

Expand Down