|
| 1 | +--- |
| 2 | +page_type: sample |
| 3 | +languages: |
| 4 | +- java |
| 5 | +products: |
| 6 | +- azure-key-vault |
| 7 | +name: Enable RestTemplate SSL from Azure Key Vault SSL Bundles in Spring Boot web Application |
| 8 | +description: This sample demonstrates how to enable RestTemplate SSL via Azure KeyVault SSL bundles in Spring Boot web application. |
| 9 | +--- |
| 10 | + |
| 11 | +# Enable RestTemplate SSL from Azure Key Vault SSL Bundles in Spring Boot Web Application |
| 12 | + |
| 13 | +This sample demonstrates how to enable RestTemplate SSL via Azure KeyVault SSL bundles in Spring Boot web application. |
| 14 | + |
| 15 | +## What You Will Build |
| 16 | + |
| 17 | +You will build an application that use `spring-cloud-azure-starter-keyvault-jca` to retrieve certificates from multiple [Azure Key Vault](https://azure.microsoft.com/services/key-vault/). |
| 18 | + |
| 19 | +## What You Need |
| 20 | + |
| 21 | +- [An Azure subscription](https://azure.microsoft.com/free/) |
| 22 | +- [Terraform](https://www.terraform.io/) |
| 23 | +- [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli) |
| 24 | +- [JDK 17](https://www.oracle.com/java/technologies/downloads/) or later |
| 25 | +- [Maven](https://maven.apache.org/download.cgi) |
| 26 | +- You can also import the code straight into your IDE: |
| 27 | + - [IntelliJ IDEA](https://www.jetbrains.com/idea/download) |
| 28 | + |
| 29 | +## Provision Azure Resources Required to Run This Sample |
| 30 | + |
| 31 | +### Authenticate Using the Azure CLI |
| 32 | +Terraform must authenticate to Azure to create infrastructure. |
| 33 | + |
| 34 | +In your terminal, use the Azure CLI tool to setup your account permissions locally. |
| 35 | + |
| 36 | +```shell |
| 37 | +az login |
| 38 | +``` |
| 39 | + |
| 40 | +Your browser window will open and you will be prompted to enter your Azure login credentials. After successful authentication, your terminal will display your subscription information. You do not need to save this output as it is saved in your system for Terraform to use. |
| 41 | + |
| 42 | +```shell |
| 43 | +You have logged in. Now let us find all the subscriptions to which you have access... |
| 44 | + |
| 45 | +[ |
| 46 | + { |
| 47 | + "cloudName": "AzureCloud", |
| 48 | + "homeTenantId": "home-Tenant-Id", |
| 49 | + "id": "subscription-id", |
| 50 | + "isDefault": true, |
| 51 | + "managedByTenants": [], |
| 52 | + "name": "Subscription-Name", |
| 53 | + "state": "Enabled", |
| 54 | + "tenantId": "0envbwi39-TenantId", |
| 55 | + "user": { |
| 56 | + |
| 57 | + "type": "user" |
| 58 | + } |
| 59 | + } |
| 60 | +] |
| 61 | +``` |
| 62 | + |
| 63 | +If you have more than one subscription, specify the subscription-id you want to use with command below: |
| 64 | +```shell |
| 65 | +az account set --subscription <your-subscription-id> |
| 66 | +``` |
| 67 | + |
| 68 | +### Provision the Resources |
| 69 | +After login Azure CLI with your account, now you can use the terraform script to create Azure Resources. |
| 70 | + |
| 71 | +#### Run with Bash |
| 72 | + |
| 73 | +```shell |
| 74 | +# In the root directory of the sample |
| 75 | +# Initialize your Terraform configuration |
| 76 | +terraform -chdir=./terraform init |
| 77 | + |
| 78 | +# Apply your Terraform Configuration |
| 79 | +terraform -chdir=./terraform apply -auto-approve |
| 80 | + |
| 81 | +``` |
| 82 | + |
| 83 | +#### Run with Powershell |
| 84 | + |
| 85 | +```shell |
| 86 | +# In the root directory of the sample |
| 87 | +# Initialize your Terraform configuration |
| 88 | +terraform -chdir=terraform init |
| 89 | + |
| 90 | +# Apply your Terraform Configuration |
| 91 | +terraform -chdir=terraform apply -auto-approve |
| 92 | + |
| 93 | +``` |
| 94 | + |
| 95 | +It may take a few minutes to run the script. After successful running, you will see prompt information like below: |
| 96 | + |
| 97 | +```shell |
| 98 | +... |
| 99 | +azurecaf_name.azurecaf_name_kv_01: Creating... |
| 100 | +azurecaf_name.azurecaf_name_kv_02: Creating... |
| 101 | +azurecaf_name.resource_group: Creating... |
| 102 | +azurecaf_name.azurecaf_name_kv_01: Creation complete after 0s [id=tsnjmjbuwvumasse] |
| 103 | +azurecaf_name.resource_group: Creation complete after 0s [id=ddeodontheybkwgm] |
| 104 | +azurecaf_name.azurecaf_name_kv_02: Creation complete after 0s [id=tsnjmjbuwvumasse] |
| 105 | +azuread_application.app: Creating... |
| 106 | +azuread_application.app: Creation complete after 3s [id=37a44efb-1cd2-44e4-a149-d9bb9c315d6f] |
| 107 | +azuread_application_password.service_principal_password: Creating... |
| 108 | +azuread_service_principal.service_principal: Creating... |
| 109 | + |
| 110 | + |
| 111 | +Apply complete! Resources: 11 added, 0 changed, 0 destroyed. |
| 112 | + |
| 113 | +Outputs: |
| 114 | + |
| 115 | +... |
| 116 | + |
| 117 | +``` |
| 118 | + |
| 119 | +You can go to [Azure portal](https://ms.portal.azure.com/) in your web browser to check the resources you created. |
| 120 | + |
| 121 | +### Export Output to Your Local Environment |
| 122 | +Running the command below to export environment values: |
| 123 | + |
| 124 | +#### Run with Bash |
| 125 | + |
| 126 | +```shell |
| 127 | +source ./terraform/setup_env.sh |
| 128 | +``` |
| 129 | + |
| 130 | +#### Run with Powershell |
| 131 | + |
| 132 | +```shell |
| 133 | +terraform\setup_env.ps1 |
| 134 | +``` |
| 135 | + |
| 136 | +If you want to run the sample in debug mode, you can save the output value. |
| 137 | + |
| 138 | +```shell |
| 139 | +KEY_VAULT_SSL_BUNDLES_CLIENT_ID= |
| 140 | +KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET= |
| 141 | +KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01= |
| 142 | +KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02= |
| 143 | +KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME= |
| 144 | +KEY_VAULT_SSL_BUNDLES_TENANT_ID= |
| 145 | +``` |
| 146 | + |
| 147 | +## Run Locally |
| 148 | + |
| 149 | +### Run the sample with Maven |
| 150 | + |
| 151 | +In your terminal, run `mvn clean spring-boot:run`. |
| 152 | + |
| 153 | +```shell |
| 154 | +mvn clean spring-boot:run |
| 155 | +``` |
| 156 | + |
| 157 | +### Run the sample in IDEs |
| 158 | + |
| 159 | +You can debug your sample by adding the saved output values to the tool's environment variables or the sample's `application.yaml` file. |
| 160 | + |
| 161 | +* If your tool is `IDEA`, please refer to [Debug your first Java application](https://www.jetbrains.com/help/idea/debugging-your-first-java-application.html) and [add environment variables](https://www.jetbrains.com/help/objc/add-environment-variables-and-program-arguments.html#add-environment-variables). |
| 162 | + |
| 163 | +* If your tool is `ECLIPSE`, please refer to [Debugging the Eclipse IDE for Java Developers](https://www.eclipse.org/community/eclipse_newsletter/2017/june/article1.php) and [Eclipse Environment Variable Setup](https://examples.javacodegeeks.com/desktop-java/ide/eclipse/eclipse-environment-variable-setup-example/). |
| 164 | + |
| 165 | +## Verify This Sample |
| 166 | + |
| 167 | +This sample requires an SSL server, you can use sample `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` as the target server, which means the https://localhost:8444/ssl-test is available. For Azure resource usage, you can share the output environment variable of `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-server` or create the new resources and shared to `spring-cloud-azure-starter-keyvault-jca/ssl-bundles-rest-template` as they use the same environment variables. |
| 168 | + |
| 169 | +1. Send below request to acquire a resource with TLS connection, the server side should not enable client-auth via property `server.ssl.client-auth=NEED`: |
| 170 | + |
| 171 | + ```bash |
| 172 | + curl http://localhost:8080/resttemplate/tls |
| 173 | + ``` |
| 174 | + |
| 175 | + You will see the following in the console: |
| 176 | + |
| 177 | + ```console |
| 178 | + Response from restTemplate tls "https://localhost:8443/ssl-test": Inbound TLS is working! |
| 179 | + ``` |
| 180 | + |
| 181 | +2. Send below request to acquire a resource with mTLS connection, the server side should enable client-auth via property `server.ssl.client-auth=NEED`: |
| 182 | + |
| 183 | + ```bash |
| 184 | + curl http://localhost:8080/resttemplate/mtls |
| 185 | + ``` |
| 186 | + |
| 187 | + you will see console like this: |
| 188 | + |
| 189 | + ```console |
| 190 | + Response from restTemplate mtls "https://localhost:8443/ssl-test": Inbound TLS is working! |
| 191 | + ``` |
| 192 | + |
| 193 | +## Clean Up Resources |
| 194 | +After running the sample, if you don't want to run the sample, remember to destroy the Azure resources you created to avoid unnecessary billing. |
| 195 | + |
| 196 | +The terraform destroy command terminates resources managed by your Terraform project. |
| 197 | +To destroy the resources you created. |
| 198 | + |
| 199 | +#### Run with Bash |
| 200 | + |
| 201 | +```shell |
| 202 | +terraform -chdir=./terraform destroy -auto-approve |
| 203 | +``` |
| 204 | + |
| 205 | +#### Run with Powershell |
| 206 | + |
| 207 | +```shell |
| 208 | +terraform -chdir=terraform destroy -auto-approve |
| 209 | +``` |
0 commit comments