Skip to content

Commit fb1ea80

Browse files
MatKuhrJonas-Isr
MatKuhr
and
Jonas-Isr
authored
feat: [Connectivity] Dynamic Keystore in HttpDestination (#1202)
Co-authored-by: Jonas-Isr <jonas.israel@sap.com>
1 parent 45b2a0a commit fb1ea80

8 files changed

Lines changed: 119 additions & 44 deletions

File tree

‎cloudplatform/cloudplatform-connectivity/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/DefaultHttpDestination.java‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import java.util.Map;
1414
import java.util.Objects;
1515
import java.util.function.Function;
16+
import java.util.function.Supplier;
1617

1718
import javax.annotation.Nonnull;
1819
import javax.annotation.Nullable;
@@ -52,8 +53,8 @@ public final class DefaultHttpDestination implements HttpDestination
5253
@Delegate
5354
private final DestinationProperties baseProperties;
5455

55-
@Nullable
56-
private final KeyStore keyStore;
56+
@Nonnull
57+
private final Supplier<Option<KeyStore>> keyStoreSupplier;
5758

5859
@Nullable
5960
private final KeyStore trustStore;
@@ -98,7 +99,7 @@ private DefaultHttpDestination(
9899
@Nonnull final DestinationProperties baseProperties,
99100
@Nonnull final ComplexDestinationPropertyFactory destinationPropertyFactory,
100101
@Nullable final List<Header> customHeaders,
101-
@Nullable final KeyStore keyStore,
102+
@Nonnull final Supplier<Option<KeyStore>> keyStoreSupplier,
102103
@Nullable final KeyStore trustStore,
103104
@Nullable final List<DestinationHeaderProvider> customHeaderProviders )
104105
{
@@ -123,7 +124,7 @@ private DefaultHttpDestination(
123124
? ImmutableList.<DestinationHeaderProvider> builder().addAll(customHeaderProviders).build()
124125
: ImmutableList.of();
125126

126-
this.keyStore = keyStore;
127+
this.keyStoreSupplier = keyStoreSupplier;
127128
this.trustStore = trustStore;
128129

129130
cachedProxyConfiguration = destinationPropertyFactory.getProxyConfiguration(baseProperties);
@@ -296,7 +297,7 @@ public Option<ProxyConfiguration> getProxyConfiguration()
296297
@Override
297298
public Option<KeyStore> getKeyStore()
298299
{
299-
return Option.of(keyStore);
300+
return keyStoreSupplier.get();
300301
}
301302

302303
@Nonnull
@@ -516,7 +517,7 @@ public static Builder fromDestination( @Nonnull final Destination destination )
516517
builder
517518
.headerProviders(httpDestination.getCustomHeaderProviders().toArray(new DestinationHeaderProvider[0]));
518519

519-
httpDestination.getKeyStore().map(builder::keyStore);
520+
builder.keyStoreSupplier(httpDestination.keyStoreSupplier);
520521
httpDestination.getTrustStore().map(builder::trustStore);
521522
}
522523

@@ -538,7 +539,9 @@ public boolean equals( @Nullable final Object o )
538539
return new EqualsBuilder()
539540
.append(baseProperties, that.baseProperties)
540541
.append(customHeaders, that.customHeaders)
541-
.append(resolveCertificatesOnly(keyStore), resolveCertificatesOnly(that.keyStore))
542+
.append(
543+
resolveCertificatesOnly(keyStoreSupplier.get().getOrNull()),
544+
resolveCertificatesOnly(that.keyStoreSupplier.get().getOrNull()))
542545
.append(resolveCertificatesOnly(trustStore), resolveCertificatesOnly(that.trustStore))
543546
.isEquals();
544547
}
@@ -549,7 +552,7 @@ public int hashCode()
549552
return new HashCodeBuilder(17, 37)
550553
.append(baseProperties)
551554
.append(customHeaders)
552-
.append(resolveKeyStoreHashCode(keyStore))
555+
.append(resolveKeyStoreHashCode(keyStoreSupplier.get().getOrNull()))
553556
.append(resolveKeyStoreHashCode(trustStore))
554557
.toHashCode();
555558
}
@@ -568,11 +571,8 @@ public static class Builder
568571
private DefaultHttpDestinationBuilderProxyHandler proxyHandler =
569572
new DefaultHttpDestinationBuilderProxyHandler();
570573

571-
/**
572-
* The {@link KeyStore} to be used when communicating over HTTP.
573-
*/
574-
@Setter( onParam_ = @Nullable )
575-
KeyStore keyStore = null;
574+
@Nonnull
575+
Supplier<Option<KeyStore>> keyStoreSupplier = Option::none;
576576

577577
/**
578578
* The trust store to be used when communicating over HTTP.
@@ -582,6 +582,27 @@ public static class Builder
582582

583583
final List<DestinationHeaderProvider> customHeaderProviders = new ArrayList<>();
584584

585+
/**
586+
* The {@link KeyStore} to be used when communicating over HTTP.
587+
*/
588+
@Nonnull
589+
public Builder keyStore( @Nullable final KeyStore keyStore )
590+
{
591+
this.keyStoreSupplier = () -> Option.of(keyStore);
592+
return this;
593+
}
594+
595+
/**
596+
* A {@link Supplier<KeyStore>} to allow for dynamically resolving certificates at runtime for HTTP
597+
* communication.
598+
*/
599+
@Nonnull
600+
Builder keyStoreSupplier( @Nonnull final Supplier<Option<KeyStore>> supplier )
601+
{
602+
this.keyStoreSupplier = supplier;
603+
return this;
604+
}
605+
585606
/**
586607
* Adds the given key-value pair to the destination to be created. This will overwrite any property already
587608
* assigned to the key.
@@ -1022,7 +1043,7 @@ DefaultHttpDestination buildInternal()
10221043
builder.build(),
10231044
new ComplexDestinationPropertyFactory(),
10241045
headers,
1025-
keyStore,
1046+
keyStoreSupplier,
10261047
trustStore,
10271048
customHeaderProviders);
10281049
}

‎cloudplatform/cloudplatform-connectivity/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/DefaultHttpDestinationBuilderTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ void testFromDestination()
9696
assertThat(sut.get("bar", v -> (int) v)).containsExactly(42);
9797
assertThat(sut.headers).containsExactly(header);
9898
assertThat(sut.customHeaderProviders).containsExactly(headerProvider);
99-
assertThat(sut.keyStore).isSameAs(keyStore);
99+
assertThat(sut.keyStoreSupplier.get().getOrNull()).isSameAs(keyStore);
100100
assertThat(sut.trustStore).isSameAs(trustStore);
101101
assertThat(sut.get(DestinationProperty.TRUST_ALL)).containsExactly(true);
102102

‎cloudplatform/cloudplatform-connectivity/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/DefaultHttpDestinationTest.java‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
import com.sap.cloud.sdk.cloudplatform.security.ClientCredentials;
3939
import com.sap.cloud.sdk.cloudplatform.security.Credentials;
4040

41+
import io.vavr.control.Option;
4142
import lombok.SneakyThrows;
4243

4344
class DefaultHttpDestinationTest
@@ -206,6 +207,22 @@ void testKeyStoreAndKeyStorePasswordCanBeSetAndRead()
206207
assertThat(defaultHttpDestination.getKeyStorePassword().get()).isEqualTo(keyStorePassword);
207208
}
208209

210+
@Test
211+
void testDynamicKeyStoreSupplierIsInvokedOnEachAccess()
212+
{
213+
final KeyStore keyStore1 = mock(KeyStore.class);
214+
final KeyStore keyStore2 = mock(KeyStore.class);
215+
final KeyStore[] current = { keyStore1 };
216+
217+
final DefaultHttpDestination destination =
218+
DefaultHttpDestination.builder("some-uri").keyStoreSupplier(() -> Option.of(current[0])).build();
219+
220+
assertThat(destination.getKeyStore().get()).isSameAs(keyStore1);
221+
222+
current[0] = keyStore2;
223+
assertThat(destination.getKeyStore().get()).isSameAs(keyStore2);
224+
}
225+
209226
@Test
210227
void testTrustStoreCanBeSetAndRead()
211228
{
@@ -706,7 +723,7 @@ void testToBuilderContainsAllProperties()
706723
assertThat(sut.get("bar", v -> (int) v)).containsExactly(42);
707724
assertThat(sut.headers).containsExactly(header);
708725
assertThat(sut.customHeaderProviders).containsExactly(headerProvider);
709-
assertThat(sut.keyStore).isSameAs(keyStore);
726+
assertThat(sut.keyStoreSupplier.get().getOrNull()).isSameAs(keyStore);
710727
assertThat(sut.trustStore).isSameAs(trustStore);
711728
assertThat(sut.get(DestinationProperty.TRUST_ALL)).containsExactly(true);
712729
}

‎cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/BtpServicePropertySuppliers.java‎

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,11 @@
77

88
import java.net.URI;
99
import java.net.URISyntaxException;
10-
import java.security.KeyStore;
1110
import java.util.ArrayList;
1211
import java.util.Collections;
1312
import java.util.List;
1413

1514
import javax.annotation.Nonnull;
16-
import javax.annotation.Nullable;
1715

1816
import com.sap.cloud.environment.servicebinding.api.ServiceIdentifier;
1917
import com.sap.cloud.sdk.cloudplatform.connectivity.BtpServiceOptions.BusinessLoggingOptions;
@@ -265,28 +263,18 @@ private boolean currentTenantIsProvider()
265263
}
266264

267265
private void attachClientKeyStore( @Nonnull final OAuth2Options.Builder optionsBuilder )
268-
{
269-
final KeyStore maybeClientStore = getClientKeyStore();
270-
if( maybeClientStore != null ) {
271-
// note: in case the KS is loaded from ZTIS, the KS used for token retrieval and the KS registered here for mTLS to the target system may diverge
272-
// Token retrieval supports certificate rotation in place, but mTLS to the target system requires re-loading the destination instead.
273-
optionsBuilder.withClientKeyStore(maybeClientStore);
274-
}
275-
}
276-
277-
@Nullable
278-
private KeyStore getClientKeyStore()
279266
{
280267
final ClientIdentity clientIdentity = getClientIdentity();
268+
281269
if( clientIdentity instanceof ZtisClientIdentity ztisClientIdentity ) {
282-
return ztisClientIdentity.getKeyStore();
270+
optionsBuilder.withClientKeyStoreSupplier(ztisClientIdentity::getKeyStore);
271+
return;
283272
}
284273
if( !(clientIdentity instanceof ClientCertificate) ) {
285-
return null;
274+
return;
286275
}
287-
288276
try {
289-
return SSLContextFactory.getInstance().createKeyStore(clientIdentity);
277+
optionsBuilder.withClientKeyStore(SSLContextFactory.getInstance().createKeyStore(clientIdentity));
290278
}
291279
catch( final Exception e ) {
292280
throw new DestinationAccessException("Unable to extract client key store from IAS service binding.", e);

‎cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2Options.java‎

Lines changed: 43 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
import java.time.Duration;
66
import java.util.HashMap;
77
import java.util.Map;
8+
import java.util.function.Supplier;
89

910
import javax.annotation.Nonnull;
1011
import javax.annotation.Nullable;
@@ -65,12 +66,11 @@ public final class OAuth2Options
6566
@Getter
6667
private final TimeLimiterConfiguration timeLimiter;
6768
/**
68-
* The {@link KeyStore} to use for building an mTLS connection towards the <b>target system</b>. This
69+
* A supplier for the {@link KeyStore} to use for building an mTLS connection towards the <b>target system</b>. This
6970
* {@link KeyStore} <b>is not used</b> to build an mTLS connection towards the OAuth2 token service.
7071
*/
7172
@Nullable
72-
@Getter
73-
private final KeyStore clientKeyStore;
73+
private final Supplier<KeyStore> clientKeyStoreSupplier;
7474

7575
/**
7676
* Configuration for caching OAuth2 tokens.
@@ -112,6 +112,26 @@ public Map<String, String> getAdditionalTokenRetrievalParameters()
112112
return new HashMap<>(additionalTokenRetrievalParameters);
113113
}
114114

115+
/**
116+
* Returns the {@link KeyStore} to use for building an mTLS connection towards the <b>target system</b>, or
117+
* {@code null} if no key store is configured.
118+
*/
119+
@Nullable
120+
public KeyStore getClientKeyStore()
121+
{
122+
return clientKeyStoreSupplier != null ? clientKeyStoreSupplier.get() : null;
123+
}
124+
125+
/**
126+
* Returns the supplier for the {@link KeyStore} to use for building an mTLS connection towards the <b>target
127+
* system</b>, or {@code null} if no key store is configured.
128+
*/
129+
@Nullable
130+
Supplier<KeyStore> getClientKeyStoreSupplier()
131+
{
132+
return clientKeyStoreSupplier;
133+
}
134+
115135
/**
116136
* Returns a new {@link Builder} instance that can be used to create a customized {@link OAuth2Options} instance.
117137
*
@@ -131,7 +151,8 @@ public static class Builder
131151
{
132152
private boolean skipTokenRetrieval = false;
133153
private final Map<String, String> additionalTokenRetrievalParameters = new HashMap<>();
134-
private KeyStore clientKeyStore;
154+
@Nullable
155+
private Supplier<KeyStore> clientKeyStoreSupplier;
135156
private TimeLimiterConfiguration timeLimiter = DEFAULT_TIMEOUT;
136157
private TokenCacheParameters tokenCacheParameters = DEFAULT_TOKEN_CACHE_PARAMETERS;
137158
@Nullable
@@ -194,7 +215,23 @@ public Builder withTokenRetrievalParameters( @Nonnull final Map<String, String>
194215
@Nonnull
195216
public Builder withClientKeyStore( @Nonnull final KeyStore clientKeyStore )
196217
{
197-
this.clientKeyStore = clientKeyStore;
218+
this.clientKeyStoreSupplier = () -> clientKeyStore;
219+
return this;
220+
}
221+
222+
/**
223+
* Sets a supplier for the {@link KeyStore} to use for building an mTLS connection towards the <b>target
224+
* system</b>. The supplier is invoked on every request, allowing the key store to be rotated at runtime. This
225+
* {@link KeyStore} <b>is not used</b> to build an mTLS connection towards the OAuth2 token service.
226+
*
227+
* @param supplier
228+
* A supplier providing the {@link KeyStore} for mTLS towards the <b>target system</b>.
229+
* @return This {@link Builder}.
230+
*/
231+
@Nonnull
232+
Builder withClientKeyStoreSupplier( @Nonnull final Supplier<KeyStore> supplier )
233+
{
234+
this.clientKeyStoreSupplier = supplier;
198235
return this;
199236
}
200237

@@ -255,7 +292,7 @@ public OAuth2Options build()
255292
skipTokenRetrieval,
256293
new HashMap<>(additionalTokenRetrievalParameters),
257294
timeLimiter,
258-
clientKeyStore,
295+
clientKeyStoreSupplier,
259296
tokenCacheParameters,
260297
btpTenantApiBaseUri);
261298
}

‎cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2ServiceBindingDestinationLoader.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -255,9 +255,10 @@ HttpDestination toDestination(
255255
destinationBuilder.headerProviders(headerProvider);
256256
}
257257

258-
if( oAuth2Options.getClientKeyStore() != null ) {
258+
if( oAuth2Options.getClientKeyStoreSupplier() != null ) {
259259
log.debug("Securing communication to OAuth2 destination '{}' using mTLS.", idString);
260-
destinationBuilder.keyStore(oAuth2Options.getClientKeyStore());
260+
final var supplier = oAuth2Options.getClientKeyStoreSupplier();
261+
destinationBuilder.keyStoreSupplier(() -> Option.of(supplier.get()));
261262
}
262263

263264
return destinationBuilder.build();
@@ -292,12 +293,13 @@ HttpDestination toProxiedDestination(
292293
destinationBuilder.headerProviders(headerProvider);
293294
}
294295

295-
if( oAuth2Options.getClientKeyStore() != null ) {
296+
if( oAuth2Options.getClientKeyStoreSupplier() != null ) {
296297
log
297298
.debug(
298299
"Securing communication to OAuth2 proxy server for proxied destination '{}' using mTLS.",
299300
destinationName);
300-
destinationBuilder.keyStore(oAuth2Options.getClientKeyStore());
301+
final var supplier = oAuth2Options.getClientKeyStoreSupplier();
302+
destinationBuilder.keyStoreSupplier(() -> Option.of(supplier.get()));
301303
}
302304

303305
// don't override the proxy URL if it has been set explicitly/manually already

‎cloudplatform/connectivity-oauth/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/BtpServicePropertySuppliersTest.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -807,6 +807,16 @@ void testMutualTlsWithZeroTrustIdentityService()
807807
.isInstanceOf(CloudPlatformException.class)
808808
.describedAs("We are not mocking the ZTIS service here so this should fail")
809809
.hasRootCauseInstanceOf(ServiceBindingAccessException.class);
810+
811+
// verify that the OAuth2Options holds a dynamic supplier (not a static KeyStore copy)
812+
final OAuth2Options oAuth2Options = sut.getOAuth2Options();
813+
assertThat(oAuth2Options.getClientKeyStoreSupplier())
814+
.describedAs("ZTIS binding must use a dynamic KeyStore supplier")
815+
.isNotNull();
816+
assertThatThrownBy(oAuth2Options::getClientKeyStore)
817+
.isInstanceOf(CloudPlatformException.class)
818+
.describedAs("Supplier invocation must propagate ZTIS failure")
819+
.hasRootCauseInstanceOf(ServiceBindingAccessException.class);
810820
}
811821

812822
@Test

‎release_notes.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
### 📈 Improvements
1818

19-
-
19+
- Further improve the automated certificate rotation support for the credential type `X509_ATTESTED`.
2020

2121
### 🐛 Fixed Issues
2222

0 commit comments

Comments
 (0)