feat: System-managed and RBAC support to access to KV and Storage. (#72)

pagopa · Oct 31, 2023 · e33d1f4 · e33d1f4
1 parent d2ed379
commit e33d1f4
Show file tree

Hide file tree

Showing 39 changed files with 542 additions and 265 deletions.
diff --git a/...keyvault/bean/GetAccessTokenResponse.java → ...ure/auth/bean/GetAccessTokenResponse.java b/...keyvault/bean/GetAccessTokenResponse.java → ...ure/auth/bean/GetAccessTokenResponse.java
@@ -3,7 +3,7 @@
  *
  * 21 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.auth.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...azurekeyvault/client/AzureAuthClient.java → ...th/azure/auth/client/AzureAuthClient.java b/...azurekeyvault/client/AzureAuthClient.java → ...th/azure/auth/client/AzureAuthClient.java
@@ -3,17 +3,17 @@
  *
  * 23 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.client;
+package it.pagopa.swclient.mil.auth.azure.auth.client;
 
 import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
 
+import io.quarkus.rest.client.reactive.ClientQueryParam;
 import io.smallrye.mutiny.Uni;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.GetAccessTokenResponse;
+import it.pagopa.swclient.mil.auth.azure.auth.bean.GetAccessTokenResponse;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.HeaderParam;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 
 /**
@@ -22,17 +22,14 @@
 @RegisterRestClient(configKey = "azure-auth-api")
 public interface AzureAuthClient {
 	/**
-	 * @param tenantId
-	 * @param grantType
-	 * @param clientId
-	 * @param clientSecret
+	 * @param identity
 	 * @param scope
 	 * @return
 	 */
-	@Path("?resource={scope}&api-version=2019-08-01")
 	@GET
 	@Produces(MediaType.APPLICATION_JSON)
+	@ClientQueryParam(name = "api-version", value = "${azure-auth-api.version}")
 	Uni<GetAccessTokenResponse> getAccessToken(
 		@HeaderParam("x-identity-header") String identity,
-		@PathParam("scope") String scope);
+		@QueryParam("resource") String scope);
 }
diff --git a/src/main/java/it/pagopa/swclient/mil/auth/azure/auth/service/AzureAuthService.java b/src/main/java/it/pagopa/swclient/mil/auth/azure/auth/service/AzureAuthService.java
@@ -0,0 +1,56 @@
+/*
+ * AzureAuthService.java
+ *
+ * 1 ago 2023
+ */
+package it.pagopa.swclient.mil.auth.azure.auth.service;
+
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.rest.client.inject.RestClient;
+
+import io.quarkus.logging.Log;
+import io.smallrye.mutiny.Uni;
+import it.pagopa.swclient.mil.auth.azure.auth.bean.GetAccessTokenResponse;
+import it.pagopa.swclient.mil.auth.azure.auth.client.AzureAuthClient;
+import jakarta.enterprise.context.ApplicationScoped;
+
+/**
+ * @author Antonio Tarricone
+ */
+@ApplicationScoped
+public class AzureAuthService {
+	/*
+	 * Scopes for authentication.
+	 */
+	//private static final String VAULT = "https://vault.azure.net/.default";
+	public static final String VAULT = "https://vault.azure.net";
+	public static final String STORAGE = "https://storage.azure.com";
+
+	/*
+	 *
+	 */
+	@RestClient
+	AzureAuthClient client;
+
+	/*
+	 *
+	 */
+	@ConfigProperty(name = "azure-auth-api.identity")
+	String identity;
+
+	/**
+	 * @return
+	 */
+	public Uni<GetAccessTokenResponse> getAccessToken() {
+		Log.debug("Authenticating to Azure AD for Key Vault.");
+		return client.getAccessToken(identity, VAULT);
+	}
+
+	/**
+	 * @return
+	 */
+	public Uni<GetAccessTokenResponse> getAccessTokenForStorage() {
+		Log.debug("Authenticating to Azure AD for Storage Account.");
+		return client.getAccessToken(identity, STORAGE);
+	}
+}
diff --git a/...mil/auth/azurekeyvault/bean/BasicKey.java → ...il/auth/azure/keyvault/bean/BasicKey.java b/...mil/auth/azurekeyvault/bean/BasicKey.java → ...il/auth/azure/keyvault/bean/BasicKey.java
@@ -3,7 +3,7 @@
  *
  * 19 set 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/.../azurekeyvault/bean/CreateKeyRequest.java → ...azure/keyvault/bean/CreateKeyRequest.java b/.../azurekeyvault/bean/CreateKeyRequest.java → ...azure/keyvault/bean/CreateKeyRequest.java
@@ -3,7 +3,7 @@
  *
  * 23 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/.../auth/azurekeyvault/bean/DetailedKey.java → ...auth/azure/keyvault/bean/DetailedKey.java b/.../auth/azurekeyvault/bean/DetailedKey.java → ...auth/azure/keyvault/bean/DetailedKey.java
@@ -3,7 +3,7 @@
  *
  * 19 set 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...h/azurekeyvault/bean/GetKeysResponse.java → .../azure/keyvault/bean/GetKeysResponse.java b/...h/azurekeyvault/bean/GetKeysResponse.java → .../azure/keyvault/bean/GetKeysResponse.java
@@ -3,7 +3,7 @@
  *
  * 24 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...ient/mil/auth/azurekeyvault/bean/Key.java → ...ent/mil/auth/azure/keyvault/bean/Key.java b/...ient/mil/auth/azurekeyvault/bean/Key.java → ...ent/mil/auth/azure/keyvault/bean/Key.java
@@ -3,7 +3,7 @@
  *
  * 19 set 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...uth/azurekeyvault/bean/KeyAttributes.java → ...th/azure/keyvault/bean/KeyAttributes.java b/...uth/azurekeyvault/bean/KeyAttributes.java → ...th/azure/keyvault/bean/KeyAttributes.java
@@ -3,7 +3,7 @@
  *
  * 23 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...l/auth/azurekeyvault/bean/KeyDetails.java → .../auth/azure/keyvault/bean/KeyDetails.java b/...l/auth/azurekeyvault/bean/KeyDetails.java → .../auth/azure/keyvault/bean/KeyDetails.java
@@ -3,7 +3,7 @@
  *
  * 19 set 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...azurekeyvault/bean/KeyNameAndVersion.java → ...zure/keyvault/bean/KeyNameAndVersion.java b/...azurekeyvault/bean/KeyNameAndVersion.java → ...zure/keyvault/bean/KeyNameAndVersion.java
@@ -3,7 +3,7 @@
  *
  * 27 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import lombok.AllArgsConstructor;
 import lombok.Getter;

diff --git a/.../auth/azurekeyvault/bean/SignRequest.java → ...auth/azure/keyvault/bean/SignRequest.java b/.../auth/azurekeyvault/bean/SignRequest.java → ...auth/azure/keyvault/bean/SignRequest.java
@@ -3,7 +3,7 @@
  *
  * 25 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...auth/azurekeyvault/bean/SignResponse.java → ...uth/azure/keyvault/bean/SignResponse.java b/...auth/azurekeyvault/bean/SignResponse.java → ...uth/azure/keyvault/bean/SignResponse.java
@@ -3,7 +3,7 @@
  *
  * 25 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...keyvault/bean/VerifySignatureRequest.java → ...keyvault/bean/VerifySignatureRequest.java b/...keyvault/bean/VerifySignatureRequest.java → ...keyvault/bean/VerifySignatureRequest.java
@@ -3,7 +3,7 @@
  *
  * 25 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...eyvault/bean/VerifySignatureResponse.java → ...eyvault/bean/VerifySignatureResponse.java b/...eyvault/bean/VerifySignatureResponse.java → ...eyvault/bean/VerifySignatureResponse.java
@@ -3,7 +3,7 @@
  *
  * 25 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.bean;
+package it.pagopa.swclient.mil.auth.azure.keyvault.bean;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;

diff --git a/...ekeyvault/client/AzureKeyVaultClient.java → .../keyvault/client/AzureKeyVaultClient.java b/...ekeyvault/client/AzureKeyVaultClient.java → .../keyvault/client/AzureKeyVaultClient.java
@@ -3,19 +3,19 @@
  *
  * 23 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.client;
+package it.pagopa.swclient.mil.auth.azure.keyvault.client;
 
 import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
 
 import io.quarkus.rest.client.reactive.ClientQueryParam;
 import io.smallrye.mutiny.Uni;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.CreateKeyRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.DetailedKey;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.GetKeysResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.SignRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.SignResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.VerifySignatureRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.VerifySignatureResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.CreateKeyRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.DetailedKey;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.GetKeysResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.SignRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.SignResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.VerifySignatureRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.VerifySignatureResponse;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.HeaderParam;

diff --git a/...azurekeyvault/service/AzureKeyFinder.java → ...zure/keyvault/service/AzureKeyFinder.java b/...azurekeyvault/service/AzureKeyFinder.java → ...zure/keyvault/service/AzureKeyFinder.java
@@ -3,7 +3,7 @@
  *
  * 26 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.service;
+package it.pagopa.swclient.mil.auth.azure.keyvault.service;
 
 import java.time.Instant;
 import java.util.Arrays;
@@ -20,15 +20,16 @@
 import io.smallrye.mutiny.Multi;
 import io.smallrye.mutiny.Uni;
 import it.pagopa.swclient.mil.auth.AuthErrorCode;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.BasicKey;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.CreateKeyRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.DetailedKey;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.GetAccessTokenResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.GetKeysResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.KeyAttributes;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.KeyDetails;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.KeyNameAndVersion;
-import it.pagopa.swclient.mil.auth.azurekeyvault.util.KidUtil;
+import it.pagopa.swclient.mil.auth.azure.auth.bean.GetAccessTokenResponse;
+import it.pagopa.swclient.mil.auth.azure.auth.service.AzureAuthService;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.BasicKey;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.CreateKeyRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.DetailedKey;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.GetKeysResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.KeyAttributes;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.KeyDetails;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.KeyNameAndVersion;
+import it.pagopa.swclient.mil.auth.azure.keyvault.util.KidUtil;
 import it.pagopa.swclient.mil.auth.bean.KeyType;
 import it.pagopa.swclient.mil.auth.bean.KeyUse;
 import it.pagopa.swclient.mil.auth.bean.PublicKey;

diff --git a/...eyvault/service/AzureKeyVaultService.java → ...eyvault/service/AzureKeyVaultService.java b/...eyvault/service/AzureKeyVaultService.java → ...eyvault/service/AzureKeyVaultService.java
@@ -3,20 +3,20 @@
  *
  * 27 lug 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.service;
+package it.pagopa.swclient.mil.auth.azure.keyvault.service;
 
 import org.eclipse.microprofile.rest.client.inject.RestClient;
 
 import io.quarkus.logging.Log;
 import io.smallrye.mutiny.Uni;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.CreateKeyRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.DetailedKey;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.GetKeysResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.SignRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.SignResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.VerifySignatureRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.VerifySignatureResponse;
-import it.pagopa.swclient.mil.auth.azurekeyvault.client.AzureKeyVaultClient;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.CreateKeyRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.DetailedKey;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.GetKeysResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.SignRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.SignResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.VerifySignatureRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.VerifySignatureResponse;
+import it.pagopa.swclient.mil.auth.azure.keyvault.client.AzureKeyVaultClient;
 import jakarta.enterprise.context.ApplicationScoped;
 
 /**
@@ -28,6 +28,7 @@ public class AzureKeyVaultService {
 	 *
 	 */
 	private static final String BEARER = "Bearer ";
+
 	/*
 	 *
 	 */

diff --git a/...urekeyvault/service/AzureTokenSigner.java → ...re/keyvault/service/AzureTokenSigner.java b/...urekeyvault/service/AzureTokenSigner.java → ...re/keyvault/service/AzureTokenSigner.java
@@ -3,7 +3,7 @@
  *
  * 1 ago 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.service;
+package it.pagopa.swclient.mil.auth.azure.keyvault.service;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -21,9 +21,10 @@
 import io.quarkus.logging.Log;
 import io.smallrye.mutiny.Uni;
 import it.pagopa.swclient.mil.auth.AuthErrorCode;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.SignRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.VerifySignatureRequest;
-import it.pagopa.swclient.mil.auth.azurekeyvault.util.SignedJWTFactory;
+import it.pagopa.swclient.mil.auth.azure.auth.service.AzureAuthService;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.SignRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.VerifySignatureRequest;
+import it.pagopa.swclient.mil.auth.azure.keyvault.util.SignedJWTFactory;
 import it.pagopa.swclient.mil.auth.service.TokenSigner;
 import it.pagopa.swclient.mil.auth.util.AuthError;
 import it.pagopa.swclient.mil.auth.util.AuthException;

diff --git a/.../mil/auth/azurekeyvault/util/KidUtil.java → ...mil/auth/azure/keyvault/util/KidUtil.java b/.../mil/auth/azurekeyvault/util/KidUtil.java → ...mil/auth/azure/keyvault/util/KidUtil.java
@@ -3,14 +3,14 @@
  *
  * 1 ago 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.util;
+package it.pagopa.swclient.mil.auth.azure.keyvault.util;
 
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 
-import it.pagopa.swclient.mil.auth.azurekeyvault.bean.KeyNameAndVersion;
+import it.pagopa.swclient.mil.auth.azure.keyvault.bean.KeyNameAndVersion;
 import jakarta.annotation.PostConstruct;
 import jakarta.enterprise.context.ApplicationScoped;
 

diff --git a/.../azurekeyvault/util/SignedJWTFactory.java → ...azure/keyvault/util/SignedJWTFactory.java b/.../azurekeyvault/util/SignedJWTFactory.java → ...azure/keyvault/util/SignedJWTFactory.java
@@ -3,7 +3,7 @@
  *
  * 4 ago 2023
  */
-package it.pagopa.swclient.mil.auth.azurekeyvault.util;
+package it.pagopa.swclient.mil.auth.azure.keyvault.util;
 
 import java.text.ParseException;