spring-projects / spring-projects/spring-vault
Update `SessionManager` implementation for non-renewable tokens
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 306
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
My organization has a vault policy which does not allow renewal of vault tokens. Therefore I am looking into creating a custom implementation of SessionManager which regenerates the token rather than attempting to renew. I have a simple implementation which seems to work:
Component
@Slf4j
public class VaultCustomSessionManager implements SessionManager {
private Optional<VaultToken> actualToken = Optional.empty();
private Optional<Long> expirationTime = Optional.empty();
private final ClientAuthentication clientAuthentication;
public VaultCustomSessionManager(final ClientAuthentication clientAuthentication) {
this.clientAuthentication = clientAuthentication;
}
@Synchronized
@Override
public VaultToken getSessionToken() {
boolean isExpired = this.expirationTime.map(expiration -> expiration < System.currentTimeMillis()).orElse(false);
if (this.actualToken.isEmpty() || isExpired) {
VaultToken newToken = this.clientAuthentication.login();
if (newToken instanceof LoginToken loginToken) {
this.expirationTime = Optional.of(System.currentTimeMillis() + loginToken.getLeaseDuration().toMillis());
} else {
// default duration to zero - do not refresh
this.expirationTime = Optional.empty();
}
this.actualToken = Optional.of(newToken);
}
return this.actualToken.get();
}
}
Is this something that could be contributed back as an autoconfiguration option for those who cannot renew tokens?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the SessionManager interface and the provided VaultCustomSessionManager implementation, including how ClientAuthentication.login() supplies a new token. Define the autoconfiguration option for non-renewable tokens and verify that expired tokens are regenerated rather than renewed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100