Skip to content

Commit a63e00f

Browse files
moarychansaragluna
andauthored
Add new samples - ssl-bundles-server, ssl-bundles-rest-template and ssl-bundles-web-client (#774)
Co-authored-by: Xiaolu Dai <[email protected]>
1 parent 5fcb55e commit a63e00f

File tree

41 files changed

+2257
-12
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+2257
-12
lines changed

README.md

+11-8
Original file line numberDiff line numberDiff line change
@@ -79,14 +79,17 @@
7979

8080
### 2.7 Azure Key Vault
8181

82-
| Sample Project | Spring Boot 3.x | Spring Boot 2.x |
83-
|-----------------------------------|-----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
84-
| keyvault-certificates-client-side ||[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-spring-boot-starter-keyvault-certificates/keyvault-certificates-client-side) |
85-
| keyvault-certificates-server-side ||[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-spring-boot-starter-keyvault-certificates/keyvault-certificates-server-side) |
86-
| run-with-command-line-server-side |[link](keyvault/azure-securtiy-keyvault-jca/run-with-command-line-server-side) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-securtiy-keyvault-jca/run-with-command-line-server-side) |
87-
| run-with-command-line-client-side |[link](keyvault/azure-securtiy-keyvault-jca/run-with-command-line-client-side) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-securtiy-keyvault-jca/run-with-command-line-client-side) |
88-
| property-source |[link](keyvault/spring-cloud-azure-starter-keyvault-secrets/property-source) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/spring-cloud-azure-starter-keyvault-secrets/property-source) |
89-
| secret-client |[link](keyvault/spring-cloud-azure-starter-keyvault-secrets/secret-client) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/spring-cloud-azure-starter-keyvault-secrets/secret-client) |
82+
| Sample Project | Spring Boot 3.x | Spring Boot 2.x |
83+
|-----------------------------------|---------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
84+
| keyvault-certificates-client-side ||[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-spring-boot-starter-keyvault-certificates/keyvault-certificates-client-side) |
85+
| keyvault-certificates-server-side ||[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-spring-boot-starter-keyvault-certificates/keyvault-certificates-server-side) |
86+
| ssl-bundles-rest-template |[link](keyvault/spring-cloud-azure-starter-keyvault-jca/ssl-bundles-rest-template) ||
87+
| ssl-bundles-server |[link](keyvault/spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server) ||
88+
| ssl-bundles-web-client |[link](keyvault/spring-cloud-azure-starter-keyvault-jca/ssl-bundles-web-client) ||
89+
| run-with-command-line-server-side |[link](keyvault/azure-securtiy-keyvault-jca/run-with-command-line-server-side) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-securtiy-keyvault-jca/run-with-command-line-server-side) |
90+
| run-with-command-line-client-side |[link](keyvault/azure-securtiy-keyvault-jca/run-with-command-line-client-side) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/azure-securtiy-keyvault-jca/run-with-command-line-client-side) |
91+
| property-source |[link](keyvault/spring-cloud-azure-starter-keyvault-secrets/property-source) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/spring-cloud-azure-starter-keyvault-secrets/property-source) |
92+
| secret-client |[link](keyvault/spring-cloud-azure-starter-keyvault-secrets/secret-client) |[link](https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-boot-2.x/keyvault/spring-cloud-azure-starter-keyvault-secrets/secret-client) |
9093

9194
### 2.8 Azure Database for MySQL
9295

aad/spring-cloud-azure-starter-active-directory/web-client-access-resource-server/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,4 @@
4242
<module>aad-web-application</module>
4343
</modules>
4444

45-
</project>
45+
</project>

cosmos/azure-spring-data-cosmos/cosmos-multi-tenant-samples/multi-tenant-by-container/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,4 @@
4343
<artifactId>azure-spring-data-cosmos</artifactId>
4444
</dependency>
4545
</dependencies>
46-
</project>
46+
</project>

cosmos/azure-spring-data-cosmos/cosmos-multi-tenant-samples/multi-tenant-by-database/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,4 @@
4343
<artifactId>azure-spring-data-cosmos</artifactId>
4444
</dependency>
4545
</dependencies>
46-
</project>
46+
</project>

cosmos/azure-spring-data-cosmos/cosmos-quickstart-samples/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,4 +44,4 @@
4444
</dependency>
4545
</dependencies>
4646

47-
</project>
47+
</project>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Spring Boot application with Azure Key Vault JCA
2+
3+
This repo demonstrates how to use [Java Crypto Architecture (JCA) Provider] for Azure Key Vault in [Spring Boot] application by Spring Boot [SSL Bundles](https://docs.spring.io/spring-boot/reference/features/ssl.html). We support using Key Vault SSL Bundles to enable embedded Web Server SSL, RestTemplate SSL, and WebClient SSL. There are three specific scenarios.
4+
5+
[Java Crypto Architecture (JCA) Provider]: https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/keyvault/azure-security-keyvault-jca
6+
[Spring Boot]: https://spring.io/projects/spring-boot
7+
8+
## Server SSL and RestTemplate SSL
9+
10+
This is the scenario to enable server SSL and `RestTemplate` SSL in a web application. It only requires running `ssl-bundles-server` standalone. You can verify it by following [ssl-bundles-server/README.md](ssl-bundles-server/README.md).
11+
12+
## mTLS for Server SSL and RestTemplate SSL
13+
14+
This mTLS scenario uses a web app as Server that enabled server SSL and needs client auth, and another web app with `RestTemplate` SSL enabled. You need to use the `ssl-bundles-server` and `ssl-bundles-rest-template` samples together. Azure resources created by either of these two sample projects can be shared with each other, so you don't need to create both.
15+
16+
### Server side mTLS:
17+
18+
Please refer to the [ssl-bundles-server/README.md](ssl-bundles-server/README.md) to configure Azure Key Vault resources, and setup environment variables.
19+
20+
Then run the following command to run Server side app locally:
21+
22+
```shell
23+
mvn clean spring-boot:run -Dspring-boot.run.profiles=client-auth
24+
```
25+
26+
### Client side mTLS
27+
28+
Use the following steps to set environment variables for `ssl-bundles-rest-template`:
29+
30+
1. Open a new terminal and navigate to the `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` directory.
31+
2. Run the following command to set the `ssl-bundles-server` environment variables to the current terminal:
32+
33+
```shell
34+
source ./terraform/setup_env.sh
35+
```
36+
37+
3. Change directory to `ssl-bundles-rest-template` project and follow [Run Locally](ssl-bundles-rest-template/README.md/#run-locally) to run and verify.
38+
39+
## mTLS for Server SSL and WebClient SSL
40+
41+
This mTLS scenario uses a web app as Server that enabled server SSL and needs client auth, and another reactive web app with `WebClient` SSL enabled. You need to use the `ssl-bundles-server` and `ssl-bundles-web-client` samples together. Azure resources created by either of these two sample projects can be shared with each other, so you don't need to create both.
42+
43+
### Server side mTLS:
44+
45+
Please refer to the [ssl-bundles-server/README.md](ssl-bundles-server/README.md) to configure Azure Key Vault resources, and setup environment variables.
46+
47+
Then run the following command to run Server side app locally:
48+
49+
```shell
50+
mvn clean spring-boot:run -Dspring-boot.run.profiles=client-auth
51+
```
52+
53+
### Client side mTLS
54+
55+
Use the following steps to set environment variables for `ssl-bundles-web-client`:
56+
57+
1. Open a new terminal and navigate to the `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` directory.
58+
2. Run the following command to set the `ssl-bundles-server` environment variables to the current terminal:
59+
60+
```shell
61+
source ./terraform/setup_env.sh
62+
```
63+
64+
3. Change directory to `ssl-bundles-web-client` project and follow [Run Locally](ssl-bundles-web-client/README.md/#run-locally) to run and verify.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
---
2+
page_type: sample
3+
languages:
4+
- java
5+
products:
6+
- azure-key-vault
7+
name: Enable RestTemplate SSL from Azure Key Vault SSL Bundles in Spring Boot web Application
8+
description: This sample demonstrates how to enable RestTemplate SSL via Azure KeyVault SSL bundles in Spring Boot web application.
9+
---
10+
11+
# Enable RestTemplate SSL from Azure Key Vault SSL Bundles in Spring Boot Web Application
12+
13+
This sample demonstrates how to enable RestTemplate SSL via Azure KeyVault SSL bundles in Spring Boot web application.
14+
15+
## What You Will Build
16+
17+
You will build an application that use `spring-cloud-azure-starter-keyvault-jca` to retrieve certificates from multiple [Azure Key Vault](https://azure.microsoft.com/services/key-vault/).
18+
19+
## What You Need
20+
21+
- [An Azure subscription](https://azure.microsoft.com/free/)
22+
- [Terraform](https://www.terraform.io/)
23+
- [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli)
24+
- [JDK 17](https://www.oracle.com/java/technologies/downloads/) or later
25+
- [Maven](https://maven.apache.org/download.cgi)
26+
- You can also import the code straight into your IDE:
27+
- [IntelliJ IDEA](https://www.jetbrains.com/idea/download)
28+
29+
## Provision Azure Resources Required to Run This Sample
30+
31+
### Authenticate Using the Azure CLI
32+
Terraform must authenticate to Azure to create infrastructure.
33+
34+
In your terminal, use the Azure CLI tool to setup your account permissions locally.
35+
36+
```shell
37+
az login
38+
```
39+
40+
Your browser window will open and you will be prompted to enter your Azure login credentials. After successful authentication, your terminal will display your subscription information. You do not need to save this output as it is saved in your system for Terraform to use.
41+
42+
```shell
43+
You have logged in. Now let us find all the subscriptions to which you have access...
44+
45+
[
46+
{
47+
"cloudName": "AzureCloud",
48+
"homeTenantId": "home-Tenant-Id",
49+
"id": "subscription-id",
50+
"isDefault": true,
51+
"managedByTenants": [],
52+
"name": "Subscription-Name",
53+
"state": "Enabled",
54+
"tenantId": "0envbwi39-TenantId",
55+
"user": {
56+
"name": "[email protected]",
57+
"type": "user"
58+
}
59+
}
60+
]
61+
```
62+
63+
If you have more than one subscription, specify the subscription-id you want to use with command below:
64+
```shell
65+
az account set --subscription <your-subscription-id>
66+
```
67+
68+
### Provision the Resources
69+
After login Azure CLI with your account, now you can use the terraform script to create Azure Resources.
70+
71+
#### Run with Bash
72+
73+
```shell
74+
# In the root directory of the sample
75+
# Initialize your Terraform configuration
76+
terraform -chdir=./terraform init
77+
78+
# Apply your Terraform Configuration
79+
terraform -chdir=./terraform apply -auto-approve
80+
81+
```
82+
83+
#### Run with Powershell
84+
85+
```shell
86+
# In the root directory of the sample
87+
# Initialize your Terraform configuration
88+
terraform -chdir=terraform init
89+
90+
# Apply your Terraform Configuration
91+
terraform -chdir=terraform apply -auto-approve
92+
93+
```
94+
95+
It may take a few minutes to run the script. After successful running, you will see prompt information like below:
96+
97+
```shell
98+
...
99+
azurecaf_name.azurecaf_name_kv_01: Creating...
100+
azurecaf_name.azurecaf_name_kv_02: Creating...
101+
azurecaf_name.resource_group: Creating...
102+
azurecaf_name.azurecaf_name_kv_01: Creation complete after 0s [id=tsnjmjbuwvumasse]
103+
azurecaf_name.resource_group: Creation complete after 0s [id=ddeodontheybkwgm]
104+
azurecaf_name.azurecaf_name_kv_02: Creation complete after 0s [id=tsnjmjbuwvumasse]
105+
azuread_application.app: Creating...
106+
azuread_application.app: Creation complete after 3s [id=37a44efb-1cd2-44e4-a149-d9bb9c315d6f]
107+
azuread_application_password.service_principal_password: Creating...
108+
azuread_service_principal.service_principal: Creating...
109+
110+
111+
Apply complete! Resources: 11 added, 0 changed, 0 destroyed.
112+
113+
Outputs:
114+
115+
...
116+
117+
```
118+
119+
You can go to [Azure portal](https://ms.portal.azure.com/) in your web browser to check the resources you created.
120+
121+
### Export Output to Your Local Environment
122+
Running the command below to export environment values:
123+
124+
#### Run with Bash
125+
126+
```shell
127+
source ./terraform/setup_env.sh
128+
```
129+
130+
#### Run with Powershell
131+
132+
```shell
133+
terraform\setup_env.ps1
134+
```
135+
136+
If you want to run the sample in debug mode, you can save the output value.
137+
138+
```shell
139+
KEY_VAULT_SSL_BUNDLES_CLIENT_ID=
140+
KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET=
141+
KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01=
142+
KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02=
143+
KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME=
144+
KEY_VAULT_SSL_BUNDLES_TENANT_ID=
145+
```
146+
147+
## Run Locally
148+
149+
### Run the sample with Maven
150+
151+
In your terminal, run `mvn clean spring-boot:run`.
152+
153+
```shell
154+
mvn clean spring-boot:run
155+
```
156+
157+
### Run the sample in IDEs
158+
159+
You can debug your sample by adding the saved output values to the tool's environment variables or the sample's `application.yaml` file.
160+
161+
* If your tool is `IDEA`, please refer to [Debug your first Java application](https://www.jetbrains.com/help/idea/debugging-your-first-java-application.html) and [add environment variables](https://www.jetbrains.com/help/objc/add-environment-variables-and-program-arguments.html#add-environment-variables).
162+
163+
* If your tool is `ECLIPSE`, please refer to [Debugging the Eclipse IDE for Java Developers](https://www.eclipse.org/community/eclipse_newsletter/2017/june/article1.php) and [Eclipse Environment Variable Setup](https://examples.javacodegeeks.com/desktop-java/ide/eclipse/eclipse-environment-variable-setup-example/).
164+
165+
## Verify This Sample
166+
167+
This sample requires an SSL server, you can use sample `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` as the target server, which means the https://localhost:8444/ssl-test is available. For Azure resource usage, you can share the output environment variable of `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` or create the new resources and shared to `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-rest-template` as they use the same environment variables.
168+
169+
1. Send below request to acquire a resource with TLS connection, the server side should not enable client-auth via property `server.ssl.client-auth=NEED`:
170+
171+
```bash
172+
curl http://localhost:8080/resttemplate/tls
173+
```
174+
175+
You will see the following in the console:
176+
177+
```console
178+
Response from restTemplate tls "https://localhost:8443/ssl-test": Inbound TLS is working!
179+
```
180+
181+
2. Send below request to acquire a resource with mTLS connection, the server side should enable client-auth via property `server.ssl.client-auth=NEED`:
182+
183+
```bash
184+
curl http://localhost:8080/resttemplate/mtls
185+
```
186+
187+
you will see console like this:
188+
189+
```console
190+
Response from restTemplate mtls "https://localhost:8443/ssl-test": Inbound TLS is working!
191+
```
192+
193+
## Clean Up Resources
194+
After running the sample, if you don't want to run the sample, remember to destroy the Azure resources you created to avoid unnecessary billing.
195+
196+
The terraform destroy command terminates resources managed by your Terraform project.
197+
To destroy the resources you created.
198+
199+
#### Run with Bash
200+
201+
```shell
202+
terraform -chdir=./terraform destroy -auto-approve
203+
```
204+
205+
#### Run with Powershell
206+
207+
```shell
208+
terraform -chdir=terraform destroy -auto-approve
209+
```
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>3.4.2</version>
9+
<relativePath/> <!-- lookup parent from repository -->
10+
</parent>
11+
<groupId>com.azure.spring</groupId>
12+
<artifactId>ssl-bundles-rest-template</artifactId>
13+
<version>1.0.0</version>
14+
<packaging>jar</packaging>
15+
<name>keyvault-ssl-bundles-rest-template</name>
16+
<description>Spring Cloud Azure Starter Key Vault JCA: Enable RestTemplate SSL in Spring Boot Web application</description>
17+
<properties>
18+
<java.version>17</java.version>
19+
<spring-cloud-azure.version>5.21.0</spring-cloud-azure.version>
20+
</properties>
21+
<dependencies>
22+
<dependency>
23+
<groupId>org.springframework.boot</groupId>
24+
<artifactId>spring-boot-starter-web</artifactId>
25+
</dependency>
26+
<dependency>
27+
<groupId>com.azure.spring</groupId>
28+
<artifactId>spring-cloud-azure-starter-keyvault-jca</artifactId>
29+
</dependency>
30+
<dependency>
31+
<groupId>org.springframework.boot</groupId>
32+
<artifactId>spring-boot-starter-test</artifactId>
33+
<scope>test</scope>
34+
</dependency>
35+
</dependencies>
36+
<dependencyManagement>
37+
<dependencies>
38+
<dependency>
39+
<groupId>com.azure.spring</groupId>
40+
<artifactId>spring-cloud-azure-dependencies</artifactId>
41+
<version>${spring-cloud-azure.version}</version>
42+
<type>pom</type>
43+
<scope>import</scope>
44+
</dependency>
45+
</dependencies>
46+
</dependencyManagement>
47+
48+
<build>
49+
<plugins>
50+
<plugin>
51+
<groupId>org.springframework.boot</groupId>
52+
<artifactId>spring-boot-maven-plugin</artifactId>
53+
</plugin>
54+
</plugins>
55+
</build>
56+
</project>

0 commit comments

Comments
 (0)