From 31b751796a686c6b076de5906d7a06223408d811 Mon Sep 17 00:00:00 2001 From: Mouhsin Elmajdouby Date: Wed, 27 Aug 2025 14:54:07 +0100 Subject: [PATCH] Remove HCP Vault Secrets --- .github/workflows/run-tests.yaml | 26 +- ojdbc-provider-aws/README.md | 2 - ojdbc-provider-azure/README.md | 2 - ojdbc-provider-gcp/README.md | 2 - ojdbc-provider-hashicorp/README.md | 526 +----------------- .../example-test.properties | 28 +- .../example-vault-secrets-wallet.properties | 78 --- .../example-vault-secrets.properties | 61 -- .../HcpVaultResourceFactory.java | 66 --- .../AbstractHcpVaultAuthentication.java | 69 --- .../AutoDetectAuthentication.java | 106 ---- .../CliCredentialsFileAuthentication.java | 77 --- .../ClientCredentialsAuthentication.java | 74 --- .../HcpVaultAuthenticationMethod.java | 106 ---- .../HcpVaultCredentialsFileAuthenticator.java | 246 -------- .../authentication/HcpVaultOAuthClient.java | 93 ---- .../HcpVaultSecretParameters.java | 205 ------- .../authentication/HcpVaultSecretToken.java | 73 --- .../authentication/HcpVaultTokenFactory.java | 135 ----- .../HcpVaultJsonVaultProvider.java | 94 ---- ...ltSecretsManagerConfigurationProvider.java | 88 --- ...cpVaultSecretConnectionStringProvider.java | 101 ---- .../HcpVaultSecretPasswordProvider.java | 71 --- .../resource/HcpVaultSecretProvider.java | 88 --- .../HcpVaultSecretResourceParameterNames.java | 60 -- .../HcpVaultSecretResourceProvider.java | 112 ---- .../resource/HcpVaultSecretSEPSProvider.java | 111 ---- .../resource/HcpVaultSecretTCPSProvider.java | 106 ---- .../HcpVaultSecretUsernameProvider.java | 71 --- .../secrets/HcpVaultApiClient.java | 101 ---- .../HcpVaultSecretsManagerFactory.java | 99 ---- .../oracle.jdbc.spi.ConnectionStringProvider | 3 +- ...racle.jdbc.spi.OracleConfigurationProvider | 3 +- ...jdbc.spi.OracleConfigurationSecretProvider | 3 +- .../services/oracle.jdbc.spi.PasswordProvider | 2 - .../oracle.jdbc.spi.TlsConfigurationProvider | 3 +- .../services/oracle.jdbc.spi.UsernameProvider | 4 +- .../hcpvaultsecret/HcpVaultTestProperty.java | 82 --- .../hcpvaultsecret/HcpVaultTestUtil.java | 97 ---- .../HcpVaultConfigurationProviderTest.java | 194 ------- .../HcpVaultConnectionStringProviderTest.java | 140 ----- .../HcpVaultPasswordProviderTest.java | 116 ---- .../resource/HcpVaultSEPSProviderTest.java | 161 ------ .../resource/HcpVaultTCPSProviderTest.java | 173 ------ .../HcpVaultUsernameProviderTest.java | 115 ---- ojdbc-provider-oci/README.md | 2 - .../SimpleVaultSecretsJsonExample.java | 101 ---- ...SimpleConnectionStringProviderExample.java | 88 --- .../SimplePasswordProviderExample.java | 82 --- .../SimpleSEPSWalletProviderExample.java | 84 --- .../SimpleTCPSWalletProviderExample.java | 89 --- .../SimpleUsernameProviderExample.java | 82 --- 52 files changed, 15 insertions(+), 4686 deletions(-) delete mode 100644 ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties delete mode 100644 ojdbc-provider-hashicorp/example-vault-secrets.properties delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultJsonVaultProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultSecretsManagerConfigurationProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretConnectionStringProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretPasswordProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceParameterNames.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretSEPSProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretTCPSProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretUsernameProvider.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultApiClient.java delete mode 100644 ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultSecretsManagerFactory.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestProperty.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestUtil.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultConfigurationProviderTest.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultConnectionStringProviderTest.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultPasswordProviderTest.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSEPSProviderTest.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultTCPSProviderTest.java delete mode 100644 ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultUsernameProviderTest.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/SimpleVaultSecretsJsonExample.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleConnectionStringProviderExample.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimplePasswordProviderExample.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleSEPSWalletProviderExample.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleTCPSWalletProviderExample.java delete mode 100644 ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleUsernameProviderExample.java diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml index 9afd78ac..8d1a0f89 100644 --- a/.github/workflows/run-tests.yaml +++ b/.github/workflows/run-tests.yaml @@ -13,10 +13,6 @@ jobs: AWS_REGION: ${{ secrets.TEST_AWS_REGION }} AWS_ACCESS_KEY_ID: ${{ secrets.TEST_AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.TEST_AWS_SECRET_ACCESS_KEY }} - VAULT_ADDR: ${{ secrets.TEST_VAULT_ADDR }} - HCP_ORG_ID: ${{ secrets.TEST_HCP_ORG_ID }} - HCP_PROJECT_ID: ${{ secrets.TEST_HCP_PROJECT_ID }} - HCP_APP_NAME: ${{ secrets.TEST_HCP_APP_NAME }} steps: - name: Checkout the repository uses: actions/checkout@v4 @@ -142,25 +138,6 @@ jobs: echo "${{ secrets.TEST_GCP_CONFIG }}" > $HOME/.gcp/config.json echo "${{ secrets.GCP_TEST_PROPERTIES }}" > ojdbc-provider-gcp/test.properties - # Generate ojdbc-provider-hashicorp/test.properties - echo -e "VAULT_ADDR=${{ secrets.TEST_VAULT_ADDR }}\n - DEDICATED_VAULT_SECRET_PATH=${{ secrets.TEST_DEDICATED_VAULT_SECRET_PATH }}\n - DEDICATED_VAULT_SECRET_PATH_WITH_MULTIPLE_KEYS=${{ secrets.TEST_DEDICATED_VAULT_SECRET_PATH_WITH_MULTIPLE_KEYS }}\n - VAULT_USERNAME=${{ secrets.TEST_VAULT_USERNAME }}\n - VAULT_PASSWORD=${{ secrets.TEST_VAULT_PASSWORD }}\n - VAULT_NAMESPACE=${{ secrets.TEST_VAULT_NAMESPACE }}\n - ROLE_ID=${{ secrets.TEST_ROLE_ID }}\n - SECRET_ID=${{ secrets.TEST_SECRET_ID }}\n - GITHUB_TOKEN=${{ secrets.TEST_GITHUB_TOKEN }}\n - KEY=${{ secrets.TEST_KEY }}\n - HCP_ORG_ID=${{ secrets.TEST_HCP_ORG_ID }}\n - HCP_PROJECT_ID=${{ secrets.TEST_HCP_PROJECT_ID }}\n - HCP_APP_NAME=${{ secrets.TEST_HCP_APP_NAME }}\n - HCP_CLIENT_ID=${{ secrets.TEST_HCP_CLIENT_ID }}\n - HCP_CLIENT_SECRET=${{ secrets.TEST_HCP_CLIENT_SECRET }}\n - SECRET_NAME=${{ secrets.TEST_SECRET_NAME }}\n - SECRET_NAME_WITH_MULTIPLE_KEYS=${{ secrets.TEST_SECRET_NAME_WITH_MULTIPLE_KEYS }}\n - " >> ojdbc-provider-hashicorp/test.properties - name: Run tests with Maven run: mvn -B test --file pom.xml @@ -180,5 +157,4 @@ jobs: rm ojdbc-provider-jackson-oson/test.properties - rm ojdbc-provider-aws/test.properties - rm ojdbc-provider-hashicorp/test.properties + rm ojdbc-provider-aws/test.properties \ No newline at end of file diff --git a/ojdbc-provider-aws/README.md b/ojdbc-provider-aws/README.md index 8697cf56..c9157ad0 100644 --- a/ojdbc-provider-aws/README.md +++ b/ojdbc-provider-aws/README.md @@ -136,7 +136,6 @@ For the JSON type of provider (AWS S3, AWS Secrets Manager, AWS Parameter Store, - `awssecretsmanager` (AWS Secrets Manager) - `awsparameterstore` (AWS Parameter Store) - `hcpvaultdedicated` (HCP Vault Dedicated) - - `hcpvaultsecret` (HCP Vault Secrets) - `gcpsecretmanager` (GCP Secret Manager) - `value` - Mandatory @@ -147,7 +146,6 @@ For the JSON type of provider (AWS S3, AWS Secrets Manager, AWS Parameter Store, - AWS Secret name (if awssecretsmanager) - AWS Parameter name (if awsparameterstore) - Secret path (if hcpvaultdedicated) - - Secret name (if hcpvaultsecret) - Secret name (if gcpsecretmanager) - `field_name` - Optional diff --git a/ojdbc-provider-azure/README.md b/ojdbc-provider-azure/README.md index cf9abcf9..6e468b95 100644 --- a/ojdbc-provider-azure/README.md +++ b/ojdbc-provider-azure/README.md @@ -115,7 +115,6 @@ For the JSON type of provider (Azure Key Vault, HTTP/HTTPS, File) the password i - `base64` (Base64) - `awssecretsmanager` (AWS Secrets Manager) - `hcpvaultdedicated` (HCP Vault Dedicated) - - `hcpvaultsecret` (HCP Vault Secrets) - `gcpsecretmanager` (GCP Secret Manager) - `value` - Mandatory @@ -125,7 +124,6 @@ For the JSON type of provider (Azure Key Vault, HTTP/HTTPS, File) the password i - Base64 Encoded password (if base64) - AWS Secret name (if awssecretsmanager) - Secret path (if hcpvaultdedicated) - - Secret name (if hcpvaultsecret) - Secret name (if gcpsecretmanager) - `authentication` - Optional diff --git a/ojdbc-provider-gcp/README.md b/ojdbc-provider-gcp/README.md index bad1cce5..7f4db538 100644 --- a/ojdbc-provider-gcp/README.md +++ b/ojdbc-provider-gcp/README.md @@ -146,7 +146,6 @@ For the JSON type of provider (GCP Object Storage, HTTP/HTTPS, File) the passwor - `base64` (Base64) - `awssecretsmanager` (AWS Secrets Manager) - `hcpvaultdedicated` (HCP Vault Dedicated) - - `hcpvaultsecret` (HCP Vault Secrets) - `value` - Mandatory - Possible values @@ -156,7 +155,6 @@ For the JSON type of provider (GCP Object Storage, HTTP/HTTPS, File) the passwor - Base64 Encoded password (if base64) - AWS Secret name (if awssecretsmanager) - Secret path (if hcpvaultdedicated) - - Secret name (if hcpvaultsecret) - `authentication` - Optional - Possible Values diff --git a/ojdbc-provider-hashicorp/README.md b/ojdbc-provider-hashicorp/README.md index 4770d279..a3dc99f7 100644 --- a/ojdbc-provider-hashicorp/README.md +++ b/ojdbc-provider-hashicorp/README.md @@ -6,8 +6,6 @@ and HashiCorp Vault (HCP). ## Centralized Config Providers
HashiCorp Vault Dedicated Config Provider
-
Provides connection properties managed by the Vault Secrets service
-
HashiCorp Vault Secret Config Provider
Provides connection properties managed by the Dedicated Vault service
Caching configuration
Caching mechanism adopted by Centralized Config Providers
@@ -17,28 +15,16 @@ and HashiCorp Vault (HCP).
Dedicated Vault Username Provider
Provides a username stored in a HashiCorp Vault Dedicated.
-
HCP Vault Secrets Username Provider
-
Provides a username stored in HashiCorp Vault Secrets.
Dedicated Vault Password Provider
Provides a password stored in a HashiCorp Vault Dedicated.
-
HCP Vault Secrets Password Provider
-
Provides a password stored in HashiCorp Vault Secrets.
Dedicated Vault TCPS Wallet Provider
Provides TLS wallets from HashiCorp Vault Dedicated for secure connections.
-
HCP Vault Secrets TCPS Wallet Provider
-
Provides TLS wallets from HashiCorp Vault Secrets for secure connections.
Dedicated Vault SEPS Wallet Provider
Provides SEPS (Secure External Password Store) wallets for secure username and password retrieval from HashiCorp Vault Dedicated.
-
HCP Vault Secrets SEPS Wallet Provider
-
Provides SEPS (Secure External Password Store) wallets for secure username and password retrieval from HashiCorp Vault Secrets.
Dedicated Vault Connection String Provider
Provides connection strings based on aliases stored in a `tnsnames.ora` file within HashiCorp Vault Dedicated.
-
HCP Vault Secrets Connection String Provider
-
Provides connection strings based on aliases stored in a `tnsnames.ora` file within HashiCorp Vault Secrets.
Common Parameters for HCP Vault Dedicated Resource Providers
Defines common configuration parameters for providers using HCP Vault Dedicated.
-
Common Parameters for HCP Vault Secrets Resource Providers
-
Defines common parameters for all providers using HCP Vault Secrets.
Configuring Authentication for Resource Providers
Details supported authentication methods and usage instructions.
@@ -63,8 +49,8 @@ The coordinates for the latest release are: ## Authentication Providers use the HashiCorp Vault API to retrieve secrets and configurations. -The HashiCorp Vault Providers support two types of Vaults: **HCP Vault Dedicated** and **HCP Vault Secrets**. -Each type supports multiple authentication methods, each requiring specific parameters. +The HashiCorp Vault Providers support **HCP Vault Dedicated** with multiple authentication methods, +each requiring specific parameters. The provider searches for these parameters in the following locations in a predefined sequence: @@ -259,155 +245,11 @@ The provider automatically detects the available parameters and chooses the best **Note:** If no authentication method is explicitly specified, **AUTO_DETECT is used by default.** - -### HCP Vault Secrets - -Authentication for **HCP Vault Secrets** supports multiple methods: - -Below is an overview of the supported authentication methods: - -1. **OAuth 2.0 Client Credentials Flow** - - Uses `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` to obtain a Bearer token for authentication. - - The token is then used to retrieve secrets from HCP Vault Secrets API. - -2. **Credentials File Authentication** - - Uses a JSON file (`creds-cache.json`) containing authentication credentials (`access_token`, `refresh_token`, and `access_token_expiry`). - - If the access token is expired, it is automatically refreshed using the stored refresh token. - - If the access token is expired, it is **automatically refreshed** using the stored refresh token. - -The generated token is cached and reused until it expires, minimizing API calls to HCP Vault Secrets. - -Secrets are retrieved from the following API endpoint: -`https://api.cloud.hashicorp.com/secrets/2023-11-28/organizations/$HCP_ORG_ID/projects/$HCP_PROJECT_ID/apps/$APP_NAME/secrets` - -For more information, visit the official HashiCorp Vault documentation: [HCP Vault Secrets](https://developer.hashicorp.com/hcp/tutorials/get-started-hcp-vault-secrets/hcp-vault-secrets-retrieve-secret). - -#### OAuth 2.0 Client Credentials Flow - -This method uses OAuth 2.0 **client credentials** to obtain a **Bearer token**, which is required for authentication. -The provider searches for the following parameters: - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionRequired
HCP_CLIENT_IDThe client ID for OAuth 2.0 authenticationYes
HCP_CLIENT_SECRETThe client secret for OAuth 2.0 authenticationYes
- -In addition to the above parameters, the Common parameters -are also required. - -#### CLI CREDENTIALS FILE -This method **retrieves authentication details** from a **JSON file (`creds-cache.json`)** that contains access tokens. - -- If **HCP CLI is installed**, a **creds-cache.json** file is **automatically created** in: ~/.config/hcp/creds-cache.json -- This file contains **access_token, refresh_token, and access_token_expiry**. -- If **the token is expired**, it is **automatically refreshed** using the **refresh_token**. -- The credentials file should be a JSON file containing the following structure: - -```json -{ - "login": { - "access_token": "YOUR_ACCESS_TOKEN", - "refresh_token": "YOUR_REFRESH_TOKEN", - "access_token_expiry": "2025-01-01T12:34:56.789Z" - } -} -``` -- access_token: The current access token for API authentication. -- refresh_token: The refresh token used to obtain a new access token when expired. -- access_token_expiry: The expiration timestamp of the access_token. - -When using this method, the provider will: - * Read the file and validate the access_token. - * Refresh the token if it's expired, using the refresh_token. - * Update the file with the new token details. - -The provider searches for the following parameters: - - - - - - - - - - - - - - - - -
Parameter NameDescriptionRequired
HCP_CREDENTIALS_FILEThe path of the credentials file ( by default ~/.config/hcp/creds-cache.jsonNo
- -In addition to the above parameters, the Common parameters -are also required. - -#### AUTO_DETECT Authentication - -The **AUTO_DETECT** authentication method dynamically selects the most suitable authentication mechanism based on the provided parameters. -This eliminates the need for users to manually specify an authentication method, ensuring a seamless and efficient authentication process. - -#### Selection Order: -1. **CLI_CREDENTIALS_FILE** → If `HCP_CREDENTIALS_FILE` is provided or the default credentials file (`~/.config/hcp/creds-cache.json`) exists, it is used. -2. **CLIENT_CREDENTIALS** → If `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` are available, Client Credentials authentication is used as a fallback. - -The provider automatically detects the available parameters and chooses the best authentication method accordingly. - -**Note:** If no authentication method is explicitly specified, **AUTO_DETECT is used by default.** - -#### Common Parameters for HCP Vault Secrets authentication methods - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionRequired
HCP_ORG_IDThe organization ID associated with the VaultYes
HCP_PROJECT_IDThe project ID associated with the VaultYes
HCP_APP_NAMEThe application name in HCP Vault SecretsYes
- - ## Config Providers ### HCP Vault Dedicated Config Provider -The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpdedicatedvault://` to be able to identify that the configuration parameters should be loaded using HCP Vault Dedicated. Users need to indicate the secret path with the following syntax: +The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpvaultdedicated://` to be able to identify that the configuration parameters should be loaded using HCP Vault Dedicated. Users need to indicate the secret path with the following syntax:
 jdbc:oracle:thin:@config-hcpvaultdedicated://{secret-path}[?option1=value1&option2=value2...]
@@ -426,28 +268,6 @@ The query parameters (`option1=value1`, `option2=value2`, etc.) are optional key
 jdbc:oracle:thin:@config-hcpvaultdedicated:///v1/namespace/secret/data/secret_name?KEY=sales_app1&authentication=approle
 ```
 
-### HCP Vault Secrets Config Provider
-
-The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpvaultsecret://` to identify that the configuration parameters should be loaded using HCP Vault Secrets. Users need to indicate the secret name (`SECRET_NAME`) with the following syntax:
-
-
-jdbc:oracle:thin:@config-hcpvaultsecret://{secret-name}[?option1=value1&option2=value2...]
-
- -The `secret-name` refers to the name of the secret to retrieve from HCP Vault Secrets - -The query parameters (`option1=value1`, `option2=value2`, etc.) are optional key-value pairs that can be used to: - -- Specify authentication parameters (e.g., `HCP_CLIENT_ID`, `HCP_ORG_ID`) -- Pass additional context information required by the provider - -All parameters that can be specified as environment variables or system properties can also be provided directly in the URL. - -For example: -``` -jdbc:oracle:thin:@config-hcpvaultsecret://secret-name?HCP_APP_NAME=app-name&key=sales_app1 -``` - ### JSON Payload format There are 4 fixed values that are looked at the root level: @@ -501,53 +321,14 @@ The sample code below executes as expected with the previous configuration. System.out.println("select sysdate from dual: " + rs.getString(1)); ``` -For **HCP Vault Secrets** -For example, let's suppose a URL like: - -
 jdbc:oracle:thin:@config-hcpvaultsecret://secret-name 
-And the JSON Payload for a secret stored within the application app_name in the HCP Vault Secrets would look like the following: - -```json -{ - "connect_descriptor": "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1521)(host=adb.us-phoenix-1.oraclecloud.com))(connect_data=(service_name=xsxsxs_dbtest_medium.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)))", - "user": "scott", - "password": { - "type": "hcpvaultsecret", - "value": "secret-name" - }, - "wallet_location": { - "type": "hcpvaultsecret", - "value": "wallet-secret" - }, - "jdbc": { - "oracle.jdbc.ReadTimeout": 1000, - "defaultRowPrefetch": 20, - "autoCommit": "false" - } -} -``` - -The sample code below executes as expected with the previous configuration. - -```java - OracleDataSource ds = new OracleDataSource(); - ds.setURL("jdbc:oracle:thin:@config-hcpvaultsecret://secret-name"); - Connection cn = ds.getConnection(); - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("select sysdate from dual"); - if (rs.next()) - System.out.println("select sysdate from dual: " + rs.getString(1)); -``` - ### Password JSON Object -For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTPS, File), the password is an object itself with the following spec: +For the JSON type of provider (HCP Vault Dedicated, HTTP/HTTPS, File), the password is an object itself with the following spec: - `type` - Mandatory - Possible values - `hcpvaultdedicated` (HCP Vault Dedicated) - - `hcpvaultsecret` (HCP Vault Secrets) - `ocivault` (OCI Vault) - `azurevault` (Azure Key Vault) - `base64` (Base64) @@ -557,13 +338,12 @@ For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTP - Mandatory - Possible values - Secret path (if hcpvaultdedicated) - - Secret name (if hcpvaultsecret) - OCID of the secret (if ocivault) - Azure Key Vault URI (if azurevault) - Base64 Encoded password (if base64) - AWS Secret name (if awssecretsmanager) - Secret name (if gcpsecretmanager) -- `field_name` (HCP Vault Dedicated only) +- `field_name` (HCP Vault Dedicated) - Optional - Description: Specifies the key within the secret JSON object to retrieve the password value. For example, if the secret contains `{ "db-password": "mypassword" }`, @@ -582,7 +362,7 @@ For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTP The `oracle.net.wallet_location` connection property is not allowed in the `jdbc` object due to security reasons. Instead, users should use the `wallet_location` object to specify the wallet in the configuration. -For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTPS, File) the `wallet_location` is an object itself with the same spec as the [password JSON object](#password-json-object) mentioned above. +For the JSON type of provider (HCP Vault Dedicated, HTTPS, File) the `wallet_location` is an object itself with the same spec as the [password JSON object](#password-json-object) mentioned above. The value stored in the secret should be the Base64 representation of a supported wallet file. This is equivalent to setting the `oracle.net.wallet_location` connection property in a regular JDBC application using the following format: @@ -604,7 +384,7 @@ This property should be included inside the jdbc object of the JSON payload: } ``` -*Note: When storing a wallet in HCP Vault Dedicated or HCP Vault Secrets, store the raw Base64-encoded wallet bytes directly. The provider will automatically detect and handle the encoding correctly. +*Note: When storing a wallet in HCP Vault Dedicated, store the raw Base64-encoded wallet bytes directly. The provider will automatically detect and handle the encoding correctly. ## Resource Providers @@ -663,34 +443,6 @@ If omitted and multiple keys exist, an error is thrown. An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties). -### HCP Vault Secrets Username Provider - -The **HCP Vault Secrets Username Provider** provides Oracle JDBC with a **database username** that is managed by **HashiCorp Vault Secrets**. -This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-username`. - -In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below. - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesDefault Value
secretNameThe name of the secret in HCP Vault Secrets containing the username.Any valid secret name within the app. No default value. A value must be configured for this parameter.
- -An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties). - --- ### Dedicated Vault Password Provider @@ -749,34 +501,6 @@ If omitted and multiple keys exist, an error is thrown. An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties). -### HCP Vault Secrets Password Provider - -The **HCP Vault Secrets Password Provider** provides Oracle JDBC with a **database password** that is managed by **HashiCorp Vault Secrets**. -This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-password`. - -In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below. - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesDefault Value
secretNameThe name of the secret in HCP Vault Secrets containing the password.Any valid secret name within the app. No default value. A value must be configured for this parameter.
- -An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties). - --- ### Dedicated Vault TCPS Wallet Provider @@ -865,55 +589,6 @@ If omitted and multiple keys exist, an error is thrown. An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated-wallet.properties](example-vault-dedicated-wallet.properties). -### HCP Vault Secrets TCPS Wallet Provider - -The **HCP Vault Secrets TCPS Wallet Provide** provides Oracle JDBC with **keys and certificates** managed by **HashiCorp Vault Secrets** to establish secure **TLS connections** with an Autonomous Database. -This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-tls`. - -For example, when connecting to an Autonomous Database Serverless with **mutual TLS (mTLS)**, -you need to configure the JDBC-thin driver with its client certificate. -If this certificate is stored in a wallet file (`cwallet.sso`, `ewallet.p12`, `ewallet.pem`), -you may store it in **HCP Vault Secrets** for additional security. -This provider retrieves the wallet content from **HCP Vault Secrets** and passes it to the JDBC thin driver. - -- The **type** parameter must be specified to indicate the wallet format: **SSO, PKCS12, or PEM**. -- The **walletPassword** must be provided for wallets that require a password (**PKCS12** or password-protected **PEM** files). - -In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesDefault Value
secretNameThe name of the secret in HCP Vault Secrets containing the wallet.Any valid secret name within the app. No default value. A value must be configured for this parameter.
typeThe wallet format.SSO, PKCS12, PEM No default value. The file type must be specified.
walletPassword Optional password for **PKCS12** or protected **PEM** files. If omitted, the file is assumed to be **SSO** or an **unprotected PEM** file. Any valid password. No default value. Required for password-protected files.
- -An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets-wallet.properties](example-vault-secrets-wallet.properties). - --- ### Dedicated Vault SEPS Wallet Provider @@ -1014,65 +689,6 @@ If omitted and multiple keys exist, an error is thrown. An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated-wallet.properties](example-vault-dedicated-wallet.properties). -### HCP Vault Secrets SEPS Wallet Provider - -The **HCP Vault Secrets SEPS Wallet Provider** provides Oracle JDBC with **username and password credentials** stored in a **Secure External Password Store (SEPS) wallet** within **HCP Vault Secrets**. - -This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-seps`. - -- The SEPS wallet securely stores **encrypted database credentials**, including the **username, password, and connection strings**. - These credentials can be stored as **default values**, such as: - - `oracle.security.client.default_username` - - `oracle.security.client.default_password` - - or as indexed credentials, for example: - - `oracle.security.client.username1` - - `oracle.security.client.password1` - - `oracle.security.client.connect_string1`. - -- The provider retrieves credentials using the following logic: - 1. If `connectionStringIndex` is **not specified**, the provider attempts to retrieve the **default credentials** (`oracle.security.client.default_username` and `oracle.security.client.default_password`). - 2. If **default credentials are missing**, the provider checks for a single **set of credentials** associated with a **connection string**. - 3. If **exactly one connection string** is found, the associated credentials are used. - 4. If **multiple connection strings** exist, an **error is thrown**, prompting you to specify a `connectionStringIndex`. - 5. If `connectionStringIndex` is specified, the provider attempts to retrieve the credentials associated with the **specified connection string index** (e.g., `oracle.security.client.username{idx}`, `oracle.security.client.password{idx}`, `oracle.security.client.connect_string{idx}`). - 6. If credentials for the **specified index** are not found, an **error is thrown**, indicating that no connection string exists with that index. - -In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesDefault Value
secretNameThe name of the SEPS wallet secret in HCP Vault Secrets.Any valid secret name within the app.No default value. A value must be configured for this parameter.
walletPassword Optional password for **PKCS12 SEPS wallets**. If omitted, the wallet is assumed to be **SSO**. Any valid password for the SEPS wallet.No default value. PKCS12 wallets require a password.
connectionStringIndex (Optional) Specifies the **index** of the connection string to use when retrieving credentials from the wallet. A positive integer representing the index of the desired credential set (e.g., 1, 2, 3, etc.).No default value. If not specified, the provider follows the default behavior as described above.
- -An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets-wallet.properties](example-vault-secrets-wallet.properties). - --- ### Dedicated Vault Connection String Provider @@ -1143,46 +759,6 @@ If omitted and multiple keys exist, an error is thrown. An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties). -### HCP Vault Secrets Connection String Provider - -The **HCP Vault Secrets Connection String Provider** provides Oracle JDBC with a **connection string** -retrieved from a `tnsnames.ora` file stored in **HCP Vault Secrets**. - -This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-tnsnames`. - -This provider retrieves and decodes a `tnsnames.ora` file stored as a **base64-encoded secret** or **plain text** in **HCP Vault Secrets**, allowing selection of connection strings based on specified aliases. - -This enables flexible configuration for **secure database connections** using the alias names defined in your `tnsnames.ora` file. - -In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also requires the parameters listed below. - - - - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesDefault Value
secretNameThe name of the secret in HCP Vault Secrets containing the tnsnames.ora file.Any valid secret name within the app. No default value. A value must be configured for this parameter.
tnsAliasThe alias to retrieve the connection string.Any valid alias present in the `tnsnames.ora` file. No default value. A value must be configured for this parameter.
- -An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties). - ### Common Parameters for HCP Vault Dedicated Resource Providers Providers classified as Resource Providers in this module all support a common set of parameters. @@ -1285,73 +861,6 @@ Providers classified as Resource Providers in this module all support a common s --- -### Common Parameters for HCP Vault Secrets Resource Providers - -Providers classified as Resource Providers for HCP Vault Secrets support a common set of parameters used for authenticating with the HCP Vault Secrets API. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameter NameDescriptionAccepted ValuesSystem Property / Environment VariableDefault Value
authenticationMethodConfigures a method of authentication for HCP Vault Secrets.client_credentials, cli_credentials_file, auto-detectNot supportedauto-detect
orgIdThe organization ID associated with the HCP Vault Secrets project.A valid HCP organization ID.HCP_ORG_IDNo default value.
projectIdThe project ID associated with the HCP Vault Secrets app.A valid HCP project ID.HCP_PROJECT_IDNo default value.
appNameThe name of the application registered in HCP Vault Secrets.A valid HCP application name.HCP_APP_NAMENo default value.
clientIdThe client ID used for client credentials OAuth 2.0 authentication.A valid HCP Client ID.HCP_CLIENT_IDNo default value.
clientSecretThe client secret associated with the client ID.A valid HCP Client Secret.HCP_CLIENT_SECRETNo default value.
credentialsFileThe path to the local HCP CLI credentials file.A valid file path (e.g., ~/.config/hcp/creds-cache.json)HCP_CREDENTIALS_FILE~/.config/hcp/creds-cache.json
- ### Configuring Authentication for Resource Providers #### HCP Vault Dedicated @@ -1381,26 +890,7 @@ Supported values for `authenticationMethod`: 3. `approle` 4. `github` -#### HCP Vault Secrets - -Resource Providers that access **HCP Vault Secrets** also require authentication. -By default, the provider will **auto-detect** the method to use. -You may override this using the `authenticationMethod` parameter. - -Supported values for `authenticationMethod`: - -- **`client-credentials`** - Uses OAuth 2.0 Client Credentials Flow. Requires `clientId` and `clientSecret`. - -- **`cli-credentials-file`** - Uses the local HCP CLI credentials file (`~/.config/hcp/creds-cache.json`), which contains `access_token` and `refresh_token`. - -- **`auto-detect`** (default) - Automatically selects based on: - 1. `cli-credentials-file` (if file exists or is configured) - 2. `client-credentials` (if both `clientId` and `clientSecret` are available) - -## caching-configuration +## Caching configuration Config providers in this module store the configuration in caches to minimize the number of RPC requests to remote location. See diff --git a/ojdbc-provider-hashicorp/example-test.properties b/ojdbc-provider-hashicorp/example-test.properties index 23f03302..df134f3c 100644 --- a/ojdbc-provider-hashicorp/example-test.properties +++ b/ojdbc-provider-hashicorp/example-test.properties @@ -152,30 +152,4 @@ SEPS_WALLET_SECRET_PATH=/v1/namespace/secret/data/seps-wallet SEPS_WALLET_PASSWORD=***** # Optional index to select specific credentials from the SEPS wallet. -SEPS_CONNECTION_STRING_INDEX=1 - -################################################################################ -# HCP VAULT SECRETS CONFIGURATION -################################################################################ - -# The name of the application where the secret is stored -HCP_APP_NAME=your-app-name - -# Client ID for OAuth2 client_credentials flow -HCP_CLIENT_ID=your-client-id - -# Client Secret for OAuth2 client_credentials flow -HCP_CLIENT_SECRET=your-client-secret - -# Organization ID in HCP Vault -HCP_ORG_ID=your-organization-id - -# Project ID in HCP Vault -HCP_PROJECT_ID=your-project-id - -# Name of the secret to be fetched from the application -SECRET_NAME=your-secret-name - -# Path to the credentials file containing authentication details -# (By default: ~/.config/hcp/creds-cache.json if using HCP CLI) -HCP_CREDENTIALS_FILE=/path/to/your/creds-cache.json +SEPS_CONNECTION_STRING_INDEX=1 \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties b/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties deleted file mode 100644 index fb463555..00000000 --- a/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties +++ /dev/null @@ -1,78 +0,0 @@ -################################################################################ -# Copyright (c) 2025 Oracle and/or its affiliates. -# -# The Universal Permissive License (UPL), Version 1.0 -# -# Subject to the condition set forth below, permission is hereby granted to any -# person obtaining a copy of this software, associated documentation and/or data -# (collectively the "Software"), free of charge and under any and all copyright -# rights in the Software, and any and all patent rights owned or freely -# licensable by each licensor hereunder covering either (i) the unmodified -# Software as contributed to or provided by such licensor, or (ii) the Larger -# Works (as defined below), to deal in both -# -# (a) the Software, and -# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if -# one is included with the Software (each a "Larger Work" to which the Software -# is contributed by such licensors), -# -# without restriction, including without limitation the rights to copy, create -# derivative works of, display, perform, and distribute the Software and make, -# use, sell, offer for sale, import, export, have made, and have sold the -# Software and the Larger Work(s), and to sublicense the foregoing rights on -# either these or other terms. -# -# This license is subject to the following condition: -# The above copyright notice and either this complete permission notice or at -# a minimum a reference to the UPL must be included in all copies or -# substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -# SOFTWARE. -################################################################################ - -# An example of a connection properties file that configures Oracle JDBC to -# obtain a TLS wallet and SEPS credentials from HCP Vault Secrets Service. -# -# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file" -# connection property. For details, see: -# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE - -# Configures the HCP Vault Secrets TCPS (TLS) Wallet Provider. The secret name is -# configured as an environment variable or JVM system property named "TLS_WALLET_SECRET_NAME". -oracle.jdbc.provider.tlsConfiguration=ojdbc-provider-hcpvault-secrets-tls -oracle.jdbc.provider.tlsConfiguration.secretName=${TLS_WALLET_SECRET_NAME} - -# Configures the HCP Vault Secrets TLS Wallet Password. The password for the -# file is optional and can be configured as an environment variable or JVM -# system property named "TLS_FILE_PASSWORD". -oracle.jdbc.provider.tlsConfiguration.walletPassword=${TLS_FILE_PASSWORD} - -# Specifies the file type (SSO, PKCS12, or PEM) for the TCPS wallet. -# This can be configured as an environment variable or JVM system property named "TLS_FILE_TYPE". -oracle.jdbc.provider.tlsConfiguration.type=${TLS_FILE_TYPE} - -# Configures the HCP Vault Secrets SEPS (Secure External Password Store) Provider. -# Secret Name is configured as environment variables or JVM system properties -# named "SEPS_WALLET_SECRET_NAME". -oracle.jdbc.provider.username=ojdbc-provider-hcpvault-secrets-seps -oracle.jdbc.provider.password=ojdbc-provider-hcpvault-secrets-seps - -# Configures the Secret Name for SEPS. -oracle.jdbc.provider.username.secretPath=${SEPS_WALLET_SECRET_NAME} -oracle.jdbc.provider.password.secretPath=${SEPS_WALLET_SECRET_NAME} - -# Optional password for SEPS Wallet stored in HCP Vault Secret. -oracle.jdbc.provider.username.walletPassword=${SEPS_WALLET_PASSWORD} -oracle.jdbc.provider.password.walletPassword=${SEPS_WALLET_PASSWORD} - -# Optional connection string index for SEPS Wallet. -# This determines which set of credentials (username/password) to use from the SEPS Wallet. -oracle.jdbc.provider.username.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX} -oracle.jdbc.provider.password.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX} - diff --git a/ojdbc-provider-hashicorp/example-vault-secrets.properties b/ojdbc-provider-hashicorp/example-vault-secrets.properties deleted file mode 100644 index 19e3f957..00000000 --- a/ojdbc-provider-hashicorp/example-vault-secrets.properties +++ /dev/null @@ -1,61 +0,0 @@ -################################################################################ -# Copyright (c) 2025 Oracle and/or its affiliates. -# -# The Universal Permissive License (UPL), Version 1.0 -# -# Subject to the condition set forth below, permission is hereby granted to any -# person obtaining a copy of this software, associated documentation and/or data -# (collectively the "Software"), free of charge and under any and all copyright -# rights in the Software, and any and all patent rights owned or freely -# licensable by each licensor hereunder covering either (i) the unmodified -# Software as contributed to or provided by such licensor, or (ii) the Larger -# Works (as defined below), to deal in both -# -# (a) the Software, and -# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if -# one is included with the Software (each a "Larger Work" to which the Software -# is contributed by such licensors), -# -# without restriction, including without limitation the rights to copy, create -# derivative works of, display, perform, and distribute the Software and make, -# use, sell, offer for sale, import, export, have made, and have sold the -# Software and the Larger Work(s), and to sublicense the foregoing rights on -# either these or other terms. -# -# This license is subject to the following condition: -# The above copyright notice and either this complete permission notice or at -# a minimum a reference to the UPL must be included in all copies or -# substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -# SOFTWARE. -################################################################################ - -# An example of a connection properties file that configures Oracle JDBC to -# login using a username and password managed by HashiCorp Vault Secrets service. -# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file" -# connection property. For details, see: -# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE - -# Configures the HCP Vault Secrets Username Provider.The secret name is -# configured as an environment variable or JVM system property named "USERNAME_SECRET_NAME". -oracle.jdbc.provider.username=ojdbc-provider-hcpvault-secrets-username -oracle.jdbc.provider.username.secretName=${USERNAME_SECRET_NAME} - -# Configures the HCP Vault Secrets Password Provider.The secret name is -# configured as an environment variable or JVM system property named "PASSWORD_SECRET_NAME". -oracle.jdbc.provider.password=ojdbc-provider-hcpvault-secrets-password -oracle.jdbc.provider.password.secretName=${PASSWORD_SECRET_NAME} - -# Configures the HCP Vault Secrets Connection String Provider. The secret name and alias -# are configured as environment variables or JVM system properties named "TNSNAMES_SECRET_NAME" and "TNS_ALIAS". -oracle.jdbc.provider.connectionString=ojdbc-provider-hcpvault-secrets-tnsnames -oracle.jdbc.provider.connectionString.secretName=${TNSNAMES_SECRET_NAME} -oracle.jdbc.provider.connectionString.tnsAlias=${TNS_ALIAS} - - diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java deleted file mode 100644 index 5e88d5c1..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java +++ /dev/null @@ -1,66 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret; - -import oracle.jdbc.provider.factory.Resource; -import oracle.jdbc.provider.factory.ResourceFactory; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretToken; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultTokenFactory; -import oracle.jdbc.provider.parameter.ParameterSet; - -public abstract class HcpVaultResourceFactory implements ResourceFactory { - - @Override - public final Resource request(ParameterSet parameterSet) { - HcpVaultSecretToken credentials = HcpVaultTokenFactory - .getInstance() - .request(parameterSet) - .getContent(); - - try { - return request(credentials, parameterSet); - } catch (Exception e) { - throw new IllegalStateException( - "Request failed with parameters: " + parameterSet, e); - } - } - - public abstract Resource request( - HcpVaultSecretToken credentials, ParameterSet parameterSet); -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java deleted file mode 100644 index dc7ad40c..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java +++ /dev/null @@ -1,69 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.parameter.ParameterSet; - -import java.util.Map; - -/** - * Base class for HCP Vault Secrets authentication strategies. - *

- * Subclasses must implement methods to generate an access token and a cache key. - *

- */ -public abstract class AbstractHcpVaultAuthentication { - - /** - * Generates an HCP Vault Secrets token based on the provided parameters. - * - * @param parameterSet the parameters for the authentication request. - * @return the generated {@link HcpVaultSecretToken}. - */ - public abstract HcpVaultSecretToken generateToken(ParameterSet parameterSet); - - /** - * Generates a cache key for the authentication request. - * - * @param parameterSet the parameters for the authentication request. - * @return a {@link ParameterSet} to be used as a cache key. - */ - public abstract Map generateCacheKey(ParameterSet parameterSet); - -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java deleted file mode 100644 index 3ed5725f..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java +++ /dev/null @@ -1,106 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.parameter.ParameterSet; - -import java.util.Collections; -import java.util.Map; - -/** - * Automatically selects the best authentication method based on available parameters. - *

- * The priority order is: - *

    - *
  1. CLI_CREDENTIALS_FILE
  2. - *
  3. CLIENT_CREDENTIALS
  4. - *
- */ -public class AutoDetectAuthentication extends AbstractHcpVaultAuthentication { - - /** - * Singleton instance of {@link AutoDetectAuthentication}. - */ - public static final AutoDetectAuthentication INSTANCE = new AutoDetectAuthentication(); - - /** - * Ordered list of authentication methods by priority. - */ - private static final AbstractHcpVaultAuthentication[] AUTHENTICATION_METHODS = { - CliCredentialsFileAuthentication.INSTANCE, - ClientCredentialsAuthentication.INSTANCE - }; - - private AutoDetectAuthentication() { - // Private constructor to enforce singleton - } - - @Override - public HcpVaultSecretToken generateToken(ParameterSet parameterSet) { - IllegalStateException previousFailure = null; - - for (AbstractHcpVaultAuthentication authentication : AUTHENTICATION_METHODS) { - try { - return authentication.generateToken(parameterSet); - } catch (RuntimeException e) { - IllegalStateException failure = new IllegalStateException( - "Failed to authenticate using " + authentication.getClass().getSimpleName(), e); - if (previousFailure == null) { - previousFailure = failure; - } else { - previousFailure.addSuppressed(failure); - } - } - } - - throw previousFailure; - } - - @Override - public Map generateCacheKey(ParameterSet parameterSet) { - for (AbstractHcpVaultAuthentication authentication : AUTHENTICATION_METHODS) { - Map cacheKey = authentication.generateCacheKey(parameterSet); - if (!cacheKey.isEmpty()) { - return cacheKey; - } - } - return Collections.emptyMap(); - } - -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java deleted file mode 100644 index 0716c93a..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java +++ /dev/null @@ -1,77 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.parameter.ParameterSet; -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - -/** - * Handles authentication using a credentials file generated by the HCP CLI. - */ -public class CliCredentialsFileAuthentication extends AbstractHcpVaultAuthentication { - - /** - * Singleton instance of {@link CliCredentialsFileAuthentication}. - */ - public static final CliCredentialsFileAuthentication INSTANCE = new CliCredentialsFileAuthentication(); - - private CliCredentialsFileAuthentication() { - // Private constructor to enforce singleton - } - - @Override - public HcpVaultSecretToken generateToken(ParameterSet parameterSet) { - try { - String credentialsFile = parameterSet.getRequired(HCP_CREDENTIALS_FILE); - HcpVaultCredentialsFileAuthenticator fileAuthenticator = - new HcpVaultCredentialsFileAuthenticator(credentialsFile); - String token = fileAuthenticator.getValidAccessToken(); - return new HcpVaultSecretToken(token); - } catch (Exception e) { - throw new IllegalStateException("Failed to authenticate using HCP CLI credentials file", e); - } - } - - @Override - public Map generateCacheKey(ParameterSet parameterSet) { - return parameterSet.filterParameters(new String[]{PARAM_HCP_CREDENTIALS_FILE}); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java deleted file mode 100644 index 7bea53e2..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java +++ /dev/null @@ -1,74 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.parameter.ParameterSet; -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - -/** - * Handles authentication using the OAuth2 client_credentials flow for HCP Vault Secrets. - */ -public class ClientCredentialsAuthentication extends AbstractHcpVaultAuthentication { - - /** - * Singleton instance of {@link ClientCredentialsAuthentication}. - */ - public static final ClientCredentialsAuthentication INSTANCE = new ClientCredentialsAuthentication(); - - private ClientCredentialsAuthentication() { - // Private constructor to enforce singleton - } - - @Override - public HcpVaultSecretToken generateToken(ParameterSet parameterSet) { - String clientId = parameterSet.getRequired(HCP_CLIENT_ID); - String clientSecret = parameterSet.getRequired(HCP_CLIENT_SECRET); - String rawToken = HcpVaultOAuthClient.fetchHcpAccessToken(clientId, clientSecret); - return new HcpVaultSecretToken(rawToken); - } - - @Override - public Map generateCacheKey(ParameterSet parameterSet) { - return parameterSet.filterParameters(new String[]{ - PARAM_HCP_CLIENT_ID, PARAM_HCP_CLIENT_SECRET - }); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java deleted file mode 100644 index cc52ef50..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java +++ /dev/null @@ -1,106 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -/** - * Enumeration of authentication methods supported by HCP Vault Secrets. - *

- * This represents the different ways to authenticate with the HCP Vault Secrets API. - *

- */ -public enum HcpVaultAuthenticationMethod { - - /** - * Authentication using client credentials via the OAuth2 client_credentials flow. - *

- * This method requires the following: - *

- *
    - *
  • A Client ID provided by the HCP Vault console or associated - * with an HCP Service Principal. - *
  • - *
  • A Client Secret corresponding to the Client ID, ensuring - * secure access. - *
  • - *
- *

- * By using these credentials, the method retrieves a short-lived API token - * by calling the HCP OAuth2 endpoint. - *

- */ - CLIENT_CREDENTIALS, - - /** - * Authentication using the credentials file generated by the HCP CLI. - *

- * This method retrieves an access token from the standard CLI-generated - * credentials file located at - * System.getProperty("user.home") + "/.config/hcp/creds-cache.json". - * If the token is expired, - * it will be automatically refreshed using the stored refresh token. - *

- *

- * The credentials file must follow the standard JSON structure containing: - *

- *
-   * {
-   *   "login": {
-   *     "access_token": "...",
-   *     "refresh_token": "...",
-   *     "access_token_expiry": "..."
-   *   }
-   * }
-   * 
- *

- * The user can provide a custom path to the credentials file if needed. - *

- */ - CLI_CREDENTIALS_FILE, - - /** - * Automatically selects the best authentication method based on available parameters. - * - *

Priority order:

- *
    - *
  1. Uses the credentials file if present and valid.
  2. - *
  3. Falls back to client credentials authentication.
  4. - *
- */ - AUTO_DETECT; -} \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java deleted file mode 100644 index e551925a..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java +++ /dev/null @@ -1,246 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.hashicorp.util.HttpUtil; -import oracle.jdbc.provider.hashicorp.util.JsonUtil; -import oracle.sql.json.OracleJsonObject; - -import java.io.IOException; -import java.nio.charset.StandardCharsets; -import java.nio.file.Files; -import java.nio.file.Path; -import java.nio.file.Paths; -import java.time.Instant; -import java.time.OffsetDateTime; -import java.time.ZoneOffset; -import java.time.format.DateTimeFormatter; -import java.util.Base64; -import java.util.concurrent.locks.ReentrantLock; - -/** - * Handles authentication using the HashiCorp CLI credentials cache. - *

- * This class reads the authentication details from the CLI-generated credentials file - * (`creds-cache.json`) and manages the token lifecycle, including: - *

- *
    - *
  • Validating the access token's expiration.
  • - *
  • Refreshing the token using the stored refresh token when expired.
  • - *
  • Updating the credentials file with the new token details.
  • - *
- *

- * By default, the credentials file is expected at: - * System.getProperty("user.home") + "/.config/hcp/creds-cache.json". - * However, users can provide a custom file path through configuration. - *

- */ -public final class HcpVaultCredentialsFileAuthenticator { - private static final String TOKEN_URL = "https://auth.idp.hashicorp.com/oauth2/token"; - private static final String GRANT_TYPE = "refresh_token"; - private static final String CONTENT_TYPE = "application/x-www-form-urlencoded"; - private static final String TOKEN_REFRESH_PAYLOAD_FORMAT = "grant_type=%s&refresh_token=%s&client_id=%s"; - private static final String CREDENTIALS_JSON_FORMAT = - "{ \"login\": { \"access_token\": \"%s\", \"refresh_token\": \"%s\", \"access_token_expiry\": \"%s\" } }"; - - // JSON field constants - public static final String ACCESS_TOKEN_FIELD = "access_token"; - private static final String REFRESH_TOKEN_FIELD = "refresh_token"; - private static final String ACCESS_TOKEN_EXPIRY_FIELD = "access_token_expiry"; - private static final String EXPIRES_IN_FIELD = "expires_in"; - private static final String CLIENT_ID_FIELD = "client_id"; - private static final String LOGIN_FIELD = "login"; - - private final ReentrantLock lock = new ReentrantLock(); - - private volatile String accessToken; - private volatile String refreshToken; - private volatile Instant tokenExpiry; - - private final Path credsFilePath; - - /** - * Creates an instance of {@link HcpVaultCredentialsFileAuthenticator} to handle authentication - * via the HCP CLI credentials cache file. - * - * @param credentialsFilePath The path to the credentials file. - */ - public HcpVaultCredentialsFileAuthenticator(String credentialsFilePath) { - this.credsFilePath = Paths.get(credentialsFilePath); - } - - /** - * Retrieves a valid access token, refreshing it if expired. - * - * @return A valid access token. - * @throws IOException if authentication fails. - */ - public String getValidAccessToken() throws Exception { - lock.lock(); - try { - if (accessToken == null || isTokenExpired()) { - loadCredentials(); - if (isTokenExpired()) { - refreshAccessToken(); - } - } - return accessToken; - } finally { - lock.unlock(); - } - } - - /** - * Loads credentials from the CLI cache file. - * - * @throws IOException if there is an error reading the file - */ - private void loadCredentials() throws IOException { - if (!Files.exists(credsFilePath)) { - throw new IOException("HCP Vault credentials file not found: " + credsFilePath); - } - - String content = new String(Files.readAllBytes(credsFilePath), StandardCharsets.UTF_8); - - OracleJsonObject rootObject = JsonUtil.convertJsonToOracleJsonObject(content); - if (rootObject == null) { - throw new IOException("Failed to parse credentials file: invalid JSON format"); - } - - OracleJsonObject loginObject; - try { - loginObject = rootObject.getObject(LOGIN_FIELD); - } catch (NullPointerException e) { - throw new IOException("Invalid credentials file format: missing 'login'" + - " object", e); - } - accessToken = JsonUtil.extractField(loginObject, ACCESS_TOKEN_FIELD); - refreshToken = JsonUtil.extractField(loginObject, REFRESH_TOKEN_FIELD); - - String expiryStr = JsonUtil.extractField(loginObject, ACCESS_TOKEN_EXPIRY_FIELD); - if (expiryStr != null && !expiryStr.isEmpty()) { - tokenExpiry = OffsetDateTime.parse(expiryStr, DateTimeFormatter.ISO_OFFSET_DATE_TIME).toInstant(); - } - } - - /** - * Checks if the current token is expired. - * - * @return true if the token is expired - */ - private boolean isTokenExpired() { - return tokenExpiry == null || Instant.now().isAfter(tokenExpiry); - } - - /** - * Refreshes the access token using the refresh token. - * - * @throws IOException if the refresh operation fails - */ - private void refreshAccessToken() throws Exception { - String clientId = extractClientIdFromToken(accessToken); - if (clientId == null || refreshToken == null) { - throw new IllegalStateException("Missing required parameters for token refresh."); - } - - String payload = String.format(TOKEN_REFRESH_PAYLOAD_FORMAT, GRANT_TYPE, refreshToken, clientId); - String jsonResponse = HttpUtil.sendPostRequest(TOKEN_URL, payload, CONTENT_TYPE, null - , null); - - OracleJsonObject response = JsonUtil.convertJsonToOracleJsonObject(jsonResponse); - updateTokensFromResponse(response); - updateCredsFile(); - } - - /** - * Updates tokens and expiry from the refresh response. - * - * @param response The JSON response from the refresh request - */ - private void updateTokensFromResponse(OracleJsonObject response) { - accessToken = JsonUtil.extractField(response, ACCESS_TOKEN_FIELD); - - try { - long expiresInSeconds = response.getLong(EXPIRES_IN_FIELD); - tokenExpiry = Instant.now().plusSeconds(expiresInSeconds); - } catch (NullPointerException e) { - throw new IllegalStateException("Missing '" + EXPIRES_IN_FIELD + "' field in token response", e); - } - - // Update refresh token if provided - String newRefreshToken = JsonUtil.extractField(response, REFRESH_TOKEN_FIELD); - if (newRefreshToken != null && !newRefreshToken.isEmpty()) { - refreshToken = newRefreshToken; - } - } - - /** - * Updates the credentials cache file with new token information. - * - * @throws IOException if file writing fails - */ - private void updateCredsFile() throws IOException { - String updatedContent = String.format(CREDENTIALS_JSON_FORMAT, accessToken, - refreshToken, OffsetDateTime.ofInstant(tokenExpiry, ZoneOffset.UTC).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME) - ); - - Files.write(credsFilePath, updatedContent.getBytes(StandardCharsets.UTF_8)); - } - - /** - * Extracts the client ID from a JWT token. - * - * @param token The JWT token - * @return The extracted client ID - * @throws IllegalArgumentException if the token is invalid or client_id extraction fails. - */ - private static String extractClientIdFromToken(String token) { - try { - String[] parts = token.split("\\."); - if (parts.length != 3) { - throw new IllegalArgumentException("Invalid JWT token format."); - } - String payloadJson = new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8); - OracleJsonObject payload = JsonUtil.convertJsonToOracleJsonObject(payloadJson); - return JsonUtil.extractField(payload, CLIENT_ID_FIELD); - } catch (Exception e) { - throw new IllegalArgumentException("Failed to extract client_id from JWT token.", e); - } - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java deleted file mode 100644 index 7b1773c3..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java +++ /dev/null @@ -1,93 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.hashicorp.util.HttpUtil; -import oracle.jdbc.provider.hashicorp.util.JsonUtil; -import oracle.sql.json.OracleJsonObject; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultCredentialsFileAuthenticator.ACCESS_TOKEN_FIELD; - -/** - * A client for performing OAuth2 operations with HCP Vault Secrets. - *

- * This class implements the client_credentials flow to obtain an API token - * required for interacting with HCP Vault Secrets. - *

- */ -public final class HcpVaultOAuthClient { - - private static final String OAUTH_TOKEN_URL = "https://auth.idp.hashicorp.com/oauth/token"; - private static final String CONTENT_TYPE = "application/x-www-form-urlencoded"; - private static final String GRANT_TYPE = "client_credentials"; - private static final String AUDIENCE = "https://api.hashicorp.cloud"; - private static final String CLIENT_CREDENTIALS_PAYLOAD_FORMAT = - "grant_type=%s&client_id=%s&client_secret=%s&audience=%s"; - - private HcpVaultOAuthClient() {} - - /** - * Fetches an access token from HCP Vault Secrets using the client_credentials flow. - * - * @param clientId the OAuth2 client ID. Must not be null or empty. - * @param clientSecret the OAuth2 client secret. Must not be null or empty. - * @return the access token as a {@code String}. Never null or empty. - * @throws IllegalStateException if the token cannot be obtained. - */ - public static String fetchHcpAccessToken(String clientId, String clientSecret) { - try { - String payload = String.format( - CLIENT_CREDENTIALS_PAYLOAD_FORMAT, GRANT_TYPE, clientId, clientSecret, AUDIENCE); - - String jsonResponse = HttpUtil.sendPostRequest( - OAUTH_TOKEN_URL, - payload, - CONTENT_TYPE, - null, - null - ); - OracleJsonObject response = JsonUtil.convertJsonToOracleJsonObject(jsonResponse); - return JsonUtil.extractField(response, ACCESS_TOKEN_FIELD); - - } catch (Exception e) { - throw new IllegalStateException("Failed to fetch HCP access token", e); - } - } - -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java deleted file mode 100644 index 1f70a637..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java +++ /dev/null @@ -1,205 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.provider.hashicorp.util.Parameterutil; -import oracle.jdbc.provider.parameter.Parameter; -import oracle.jdbc.provider.parameter.ParameterSet; -import oracle.jdbc.provider.parameter.ParameterSetParser; - -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultAuthenticationMethod.AUTO_DETECT; -import static oracle.jdbc.provider.parameter.Parameter.CommonAttribute.*; - -/** - * Contains parameter definitions for interacting with HCP Vault Secrets. - *

- * This class centralizes configuration parameters used for authenticating - * with and retrieving secrets from HCP Vault Secrets. - *

- */ -public class HcpVaultSecretParameters { - - /** - * Constants representing the configuration parameter names for HCP Vault Secrets. - *

- * These constants serve as both parameter names within the {@link ParameterSet} - * and as keys for environment variables or system properties. - *

- */ - public static final String PARAM_HCP_ORG_ID = "HCP_ORG_ID"; - public static final String PARAM_HCP_PROJECT_ID = "HCP_PROJECT_ID"; - public static final String PARAM_HCP_APP_NAME = "HCP_APP_NAME"; - public static final String PARAM_HCP_CLIENT_ID = "HCP_CLIENT_ID"; - public static final String PARAM_HCP_CLIENT_SECRET = "HCP_CLIENT_SECRET"; - public static final String PARAM_HCP_CREDENTIALS_FILE = - "HCP_CREDENTIALS_FILE"; - public static final String DEFAULT_CREDENTIALS_FILE_PATH = - System.getProperty("user.home") + "/.config/hcp/creds-cache.json"; - private static final String PARAM_AUTHENTICATION = "AUTHENTICATION"; - - /** - * Parameter indicating the authentication method to use for HCP Vault Secrets. - */ - public static final Parameter AUTHENTICATION_METHOD = Parameter.create(REQUIRED); - - /** - * Parameter for the OAuth2 client ID. Required. - */ - public static final Parameter HCP_CLIENT_ID = Parameter.create(); - - /** - * Parameter for the OAuth2 client secret. Required. - */ - public static final Parameter HCP_CLIENT_SECRET = Parameter.create(); - - /** - * Parameter for the credentials file path. - * By default, the credentials file is expected at: - * System.getProperty("user.home") + "/.config/hcp/creds-cache.json". - */ - public static final Parameter HCP_CREDENTIALS_FILE = Parameter.create(); - - /** - * Parameter for the organization ID. Required. - */ - public static final Parameter HCP_ORG_ID = Parameter.create(); - - /** - * Parameter for the project ID. Required. - */ - public static final Parameter HCP_PROJECT_ID = Parameter.create(); - - /** - * Parameter for the application name. Required. - */ - public static final Parameter HCP_APP_NAME = Parameter.create(); - - /** - * Parameter for the secret name. Required. - */ - public static final Parameter SECRET_NAME = Parameter.create(REQUIRED); - - /** - * Parameter for the optional key in the secret JSON. - */ - public static final Parameter KEY = Parameter.create(); - - /** - * Builds a ParameterSet from the given options map. - *

- * This method makes a defensive copy of the provided map, ensures that a default - * authentication method is set, and then fills in missing keys using fallback values - * (from system properties or environment variables) based on the authentication method. - * Finally, it parses the updated map into a ParameterSet. - *

- * - * @param inputOpts The input options map. - * @return The ParameterSet. - */ - public static ParameterSet buildResolvedParameterSet(Map inputOpts) { - Map opts = new HashMap<>(inputOpts); - - String authStr = opts.entrySet().stream() - .filter(entry -> entry.getKey().equalsIgnoreCase(PARAM_AUTHENTICATION)) - .map(Map.Entry::getValue) - .findFirst() - .orElse(HcpVaultAuthenticationMethod.AUTO_DETECT.name()); - - HcpVaultAuthenticationMethod authMethod = - HcpVaultAuthenticationMethod.valueOf(authStr.toUpperCase()); - - opts.computeIfAbsent(PARAM_HCP_ORG_ID, Parameterutil::getFallback); - opts.computeIfAbsent(PARAM_HCP_PROJECT_ID, Parameterutil::getFallback); - opts.computeIfAbsent(PARAM_HCP_APP_NAME, Parameterutil::getFallback); - - switch (authMethod) { - case CLIENT_CREDENTIALS: - opts.computeIfAbsent(PARAM_HCP_CLIENT_ID, Parameterutil::getFallback); - opts.computeIfAbsent(PARAM_HCP_CLIENT_SECRET, Parameterutil::getFallback); - break; - case CLI_CREDENTIALS_FILE: - opts.computeIfAbsent(PARAM_HCP_CREDENTIALS_FILE, Parameterutil::getFallback); - break; - case AUTO_DETECT: - opts.computeIfAbsent(PARAM_HCP_CLIENT_ID, Parameterutil::getFallback); - opts.computeIfAbsent(PARAM_HCP_CLIENT_SECRET, Parameterutil::getFallback); - opts.computeIfAbsent(PARAM_HCP_CREDENTIALS_FILE, Parameterutil::getFallback); - break; - default: - break; - } - return PARAMETER_SET_PARSER.parseNamedValues(opts); - } - - /** - * Parses the authentication method from a string value. - * - * @param value the string value representing the authentication method. Must - * not be null. - * @return the parsed {@link HcpVaultAuthenticationMethod}. - * @throws IllegalArgumentException if the value is unrecognized. - */ - private static HcpVaultAuthenticationMethod parseAuthMethod(String value) { - try { - return HcpVaultAuthenticationMethod.valueOf(value.toUpperCase()); - } catch (IllegalArgumentException e) { - throw new IllegalArgumentException( - "Unrecognized HCP auth method: " + value, e); - } - } - - public static final ParameterSetParser PARAMETER_SET_PARSER = - ParameterSetParser.builder() - .addParameter("value", SECRET_NAME) - .addParameter(PARAM_AUTHENTICATION, AUTHENTICATION_METHOD, AUTO_DETECT, - HcpVaultSecretParameters::parseAuthMethod) - .addParameter(PARAM_HCP_ORG_ID, HCP_ORG_ID) - .addParameter(PARAM_HCP_PROJECT_ID, HCP_PROJECT_ID) - .addParameter(PARAM_HCP_APP_NAME, HCP_APP_NAME) - .addParameter(PARAM_HCP_CLIENT_ID, HCP_CLIENT_ID) - .addParameter(PARAM_HCP_CLIENT_SECRET, HCP_CLIENT_SECRET) - .addParameter(PARAM_HCP_CREDENTIALS_FILE, HCP_CREDENTIALS_FILE, DEFAULT_CREDENTIALS_FILE_PATH) - .addParameter("KEY", KEY) - .addParameter("type", Parameter.create()) - .build(); - -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java deleted file mode 100644 index 14a2d677..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java +++ /dev/null @@ -1,73 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -/** - * Represents the credentials required to authenticate with HCP Vault Secrets. - *

- * This class holds the API token obtained from the client_credentials OAuth2 flow. - *

- */ -public final class HcpVaultSecretToken { - private final String hcpApiToken; - - /** - * Constructs a new {@code HcpVaultSecretToken} object with - * the provided API token. - * - * @param hcpApiToken the token used to authenticate API requests to - * the HCP Vault Secret. Must not be null or empty. - * @throws IllegalArgumentException if {@code hcpApiToken} is null or empty. - */ - public HcpVaultSecretToken(String hcpApiToken) { - if (hcpApiToken == null || hcpApiToken.isEmpty()) { - throw new IllegalArgumentException("HCP API token must not be null or empty."); - } - this.hcpApiToken = hcpApiToken; - } - - /** - * Returns the HCP API token used for authentication. - * - * @return the HCP API token as a {@link String}. - */ - public String getHcpApiToken() { - return hcpApiToken; - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java deleted file mode 100644 index 05bfdfb1..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java +++ /dev/null @@ -1,135 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication; - -import oracle.jdbc.AccessToken; -import oracle.jdbc.driver.oauth.JsonWebToken; -import oracle.jdbc.provider.factory.Resource; -import oracle.jdbc.provider.factory.ResourceFactory; -import oracle.jdbc.provider.parameter.Parameter; -import oracle.jdbc.provider.parameter.ParameterSet; - -import java.util.Map; -import java.util.concurrent.ConcurrentHashMap; -import java.util.function.Supplier; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.AUTHENTICATION_METHOD; -import static oracle.jdbc.provider.parameter.Parameter.CommonAttribute.REQUIRED; -/** - * A factory for creating {@link HcpVaultSecretToken} objects for HCP Vault Secrets. - *

- * Implements the client_credentials flow as well as file-based authentication. - * The auto-detect mode attempts file-based authentication first, then falls back - * to client credentials. - *

- */ -public final class HcpVaultTokenFactory implements ResourceFactory { - - private static final HcpVaultTokenFactory INSTANCE = new HcpVaultTokenFactory(); - - private static final ConcurrentHashMap, Supplier> tokenCache = - new ConcurrentHashMap<>(); - - private HcpVaultTokenFactory() {} - - public static HcpVaultTokenFactory getInstance() { - return INSTANCE; - } - - @Override - public Resource request(ParameterSet parameterSet) { - HcpVaultSecretToken credentials = getCredential(parameterSet); - return Resource.createPermanentResource(credentials, true); - } - - /** - * Determines the authentication method and retrieves credentials accordingly. - * - * @param parameterSet The parameter set containing authentication details. - * @return The HCP Vault secret token. - */ - private HcpVaultSecretToken getCredential(ParameterSet parameterSet) { - HcpVaultAuthenticationMethod method = parameterSet.getRequired(AUTHENTICATION_METHOD); - AbstractHcpVaultAuthentication authentication = getAuthentication(method); - return createCachedToken(parameterSet, authentication); - } - - /** - * Creates or retrieves a cached {@link HcpVaultSecretToken} for the specified - * authentication method. - * - * @param parameterSet the set of parameters for the request. - * @param authentication the authentication method being used. - * @return a {@code HcpVaultSecretToken} instance. - */ - private HcpVaultSecretToken createCachedToken( - ParameterSet parameterSet, AbstractHcpVaultAuthentication authentication) { - - Map cacheKey = authentication.generateCacheKey(parameterSet); - - Supplier tokenSupplier = tokenCache.computeIfAbsent(cacheKey, k -> AccessToken.createJsonWebTokenCache(() -> { - HcpVaultSecretToken token = authentication.generateToken(parameterSet); - return AccessToken.createJsonWebToken(token.getHcpApiToken().toCharArray()); - })); - - AccessToken cachedToken = tokenSupplier.get(); - JsonWebToken jwt = (JsonWebToken) cachedToken; - return new HcpVaultSecretToken(jwt.token().get()); - } - - /** - * Returns the appropriate authentication strategy for the specified method. - * - * @param method the authentication method - * @return the corresponding {@link AbstractHcpVaultAuthentication} instance - */ - private AbstractHcpVaultAuthentication getAuthentication(HcpVaultAuthenticationMethod method) { - switch (method) { - case CLIENT_CREDENTIALS: - return ClientCredentialsAuthentication.INSTANCE; - case CLI_CREDENTIALS_FILE: - return CliCredentialsFileAuthentication.INSTANCE; - case AUTO_DETECT: - return AutoDetectAuthentication.INSTANCE; - default: - throw new IllegalArgumentException("Unsupported authentication method: " + method); - } - } - -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultJsonVaultProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultJsonVaultProvider.java deleted file mode 100644 index 48249dfa..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultJsonVaultProvider.java +++ /dev/null @@ -1,94 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration; - -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.secrets.HcpVaultSecretsManagerFactory; -import oracle.jdbc.provider.parameter.ParameterSet; - -import oracle.jdbc.spi.OracleConfigurationSecretProvider; - -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.PARAMETER_SET_PARSER; -import static oracle.jdbc.provider.util.FileUtils.toBase64EncodedCharArray; - -/** - *

- * Implementation of {@link OracleConfigurationSecretProvider} for - * HCP Vault Secret. This provider retrieves secrets stored in the HCP Vault - * Secret using - * the specified {@code SECRET_NAME}. - *

- *

- * The {@code jsonObject} must adhere to the following structure: - *

- * - *
{@code
- *   "password": {
- *       "type": "hcpvaultsecret",
- *       "value": "",
- *   }
- * }
- * - *

- * The {@code SECRET_NAME} the specific secret to retrieve from hcp vault. - * The secret's value is retrieved and returned as a Base64-encoded - * character array. - *

- */ -public class HcpVaultJsonVaultProvider implements OracleConfigurationSecretProvider { - - - @Override - public char[] getSecret(Map map) { - ParameterSet parameterSet = PARAMETER_SET_PARSER.parseNamedValues(map); - - String secretString = HcpVaultSecretsManagerFactory - .getInstance() - .request(parameterSet) - .getContent(); - - return toBase64EncodedCharArray(secretString); - } - - @Override - public String getSecretType() { - return "hcpvaultsecret"; - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultSecretsManagerConfigurationProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultSecretsManagerConfigurationProvider.java deleted file mode 100644 index 164c8487..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultSecretsManagerConfigurationProvider.java +++ /dev/null @@ -1,88 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration; - -import oracle.jdbc.driver.configuration.OracleConfigurationParsableProvider; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.secrets.HcpVaultSecretsManagerFactory; -import oracle.jdbc.provider.parameter.ParameterSet; -import oracle.jdbc.util.OracleConfigurationCache; - -import java.io.ByteArrayInputStream; -import java.io.InputStream; -import java.nio.charset.StandardCharsets; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - - -public class HcpVaultSecretsManagerConfigurationProvider extends OracleConfigurationParsableProvider { - - @Override - public InputStream getInputStream(String secretName) { - final String valueField = "value"; - Map optionsWithAppName = new HashMap<>(options); - optionsWithAppName.put(valueField, secretName); - - ParameterSet finalParams = buildResolvedParameterSet(optionsWithAppName); - - String secretsJson = HcpVaultSecretsManagerFactory - .getInstance() - .request(finalParams) - .getContent(); - - return new ByteArrayInputStream(secretsJson.getBytes(StandardCharsets.UTF_8)); - } - - @Override - public String getType() { - // The provider name that appears in the JDBC URL after "config-" - return "hcpvaultsecret"; - } - - @Override - public OracleConfigurationCache getCache() { - return CACHE; - } - - @Override - public String getParserType(String location) { - return "json"; - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretConnectionStringProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretConnectionStringProvider.java deleted file mode 100644 index a77862c8..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretConnectionStringProvider.java +++ /dev/null @@ -1,101 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.resource.ResourceParameter; -import oracle.jdbc.provider.util.TNSNames; -import oracle.jdbc.spi.ConnectionStringProvider; - -import java.io.ByteArrayInputStream; -import java.io.IOException; -import java.io.InputStream; -import java.util.Map; - -import static oracle.jdbc.provider.util.CommonParameters.TNS_ALIAS; -import static oracle.jdbc.provider.util.FileUtils.decodeIfBase64; - -/** - *

- * A provider for securely retrieving the connection string from a tnsnames.ora - * file stored in HCP Vault Secrets for use with an Oracle Autonomous Database. - * The tnsnames.ora file can be stored as a base64-encoded secret or as plain - * text. The provider automatically detects the format and processes the - * content accordingly to extract connection strings by alias. - *

- *

- * This class implements the {@link ConnectionStringProvider} SPI defined by - * Oracle JDBC and is designed to be instantiated via {@link java.util.ServiceLoader}. - *

- */ -public class HcpVaultSecretConnectionStringProvider - extends HcpVaultSecretProvider - implements ConnectionStringProvider { - - private static final ResourceParameter[] TNS_NAMES_PARAMETERS = { - new ResourceParameter(HcpVaultSecretResourceParameterNames.TNS_ALIAS, TNS_ALIAS) - }; - - /** - * A public no-arg constructor used by {@link java.util.ServiceLoader} to - * construct an instance of this provider. - */ - public HcpVaultSecretConnectionStringProvider() { - super("tnsnames", TNS_NAMES_PARAMETERS); - } - - @Override - public String getConnectionString(Map parameterValues) { - String alias = parseParameterValues(parameterValues).getRequired(TNS_ALIAS); - byte[] fileBytes = decodeIfBase64(getSecret(parameterValues).getBytes()); - - TNSNames tnsNames; - try (InputStream inputStream = new ByteArrayInputStream(fileBytes)) { - tnsNames = TNSNames.read(inputStream); - } catch (IOException e) { - throw new IllegalStateException("Failed to read tnsnames.ora content", e); - } - - String connectionString = tnsNames.getConnectionStringByAlias(alias); - if (connectionString == null) { - throw new IllegalArgumentException( - "Alias specified does not exist in tnsnames.ora: " + alias); - } - return connectionString; - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretPasswordProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretPasswordProvider.java deleted file mode 100644 index de4f3142..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretPasswordProvider.java +++ /dev/null @@ -1,71 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.spi.PasswordProvider; - -import java.util.Map; - -/** - *

- * A provider for retrieving password securely stored in HCP Vault Secrets. - * This provider fetches the password from the Vault and returns it as a character array. - *

- *

- * This class implements the {@link PasswordProvider} SPI defined by Oracle JDBC - * and is designed to be instantiated via {@link java.util.ServiceLoader}. - *

- */ -public class HcpVaultSecretPasswordProvider - extends HcpVaultSecretProvider - implements PasswordProvider { - - /** - * A public no-arg constructor used by {@link java.util.ServiceLoader} to - * construct an instance of this provider. - */ - public HcpVaultSecretPasswordProvider() { - super("password"); - } - - @Override - public char[] getPassword(Map parameterValues) { - return getSecret(parameterValues).toCharArray(); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretProvider.java deleted file mode 100644 index b8042813..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretProvider.java +++ /dev/null @@ -1,88 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.secrets.HcpVaultSecretsManagerFactory; -import oracle.jdbc.provider.resource.ResourceParameter; -import oracle.jdbc.provider.util.ResourceParameterUtils; - -import java.util.Map; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - -/** - *

- * A provider of secrets from HashiCorp HCP Vault Secrets. This class is designed - * for inheritance by subclasses that implement an - * {@link oracle.jdbc.spi.OracleResourceProvider} SPI defined by the Oracle JDBC - * driver. - *

- */ -public class HcpVaultSecretProvider extends HcpVaultSecretResourceProvider { - - private static final ResourceParameter[] PARAMETERS = { - new ResourceParameter(HcpVaultSecretResourceParameterNames.SECRET_NAME, SECRET_NAME), - }; - - protected HcpVaultSecretProvider(String valueType) { - super(valueType, PARAMETERS); - } - - protected HcpVaultSecretProvider(String valueType, ResourceParameter[] additionalParameters) { - super(valueType, ResourceParameterUtils.combineParameters(PARAMETERS, additionalParameters)); - } - - /** - *

- * Retrieves a secret from HashiCorp HCP Vault Secrets based on parameters - * provided in {@code parameterValues}. This method centralizes secret - * retrieval logic and is used by subclasses implementing - * the {@link oracle.jdbc.spi.OracleResourceProvider} SPI. - *

- * - * @param parameterValues A map of parameter names and their corresponding - * -values required for secret retrieval. Must not be null. - * @return The raw secret value as a {@code String}. - */ - protected final String getSecret(Map parameterValues) { - Map resolvedValues = - resolveMissingParameters(parameterValues, HcpVaultSecretResourceProvider.PARAMETERS); - return getResource(HcpVaultSecretsManagerFactory.getInstance(), resolvedValues); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceParameterNames.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceParameterNames.java deleted file mode 100644 index b18d6f07..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceParameterNames.java +++ /dev/null @@ -1,60 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -/** - * Centralized parameter name constants used by HCP Vault Secret resource providers. - */ -public final class HcpVaultSecretResourceParameterNames { - - private HcpVaultSecretResourceParameterNames() {} - - public static final String ORG_ID = "orgId"; - public static final String PROJECT_ID = "projectId"; - public static final String APP_NAME = "appName"; - public static final String CLIENT_ID = "clientId"; - public static final String CLIENT_SECRET = "clientSecret"; - public static final String CREDENTIALS_FILE = "credentialsFile"; - - public static final String SECRET_NAME = "secretName"; - public static final String TNS_ALIAS = "tnsAlias"; - public static final String CONNECTION_STRING_INDEX = "connectionStringIndex"; - public static final String WALLET_PASSWORD = "walletPassword"; - public static final String TYPE = "type"; -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceProvider.java deleted file mode 100644 index 845be3b6..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretResourceProvider.java +++ /dev/null @@ -1,112 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultAuthenticationMethod; -import oracle.jdbc.provider.hashicorp.util.AbstractVaultResourceProvider; -import oracle.jdbc.provider.resource.ResourceParameter; - -import java.util.stream.Stream; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - -/** - * Super class of all {@code OracleResourceProvider} implementations - * that request a resource from HCP Vault Secrets. This class defines - * parameters for authentication with HCP Vault Secrets. - */ -public class HcpVaultSecretResourceProvider extends AbstractVaultResourceProvider { - - static final ResourceParameter[] PARAMETERS = { - new ResourceParameter("authenticationMethod", AUTHENTICATION_METHOD, - "auto-detect", - HcpVaultSecretResourceProvider::parseAuthenticationMethod), - new ResourceParameter(HcpVaultSecretResourceParameterNames.ORG_ID, HCP_ORG_ID), - new ResourceParameter(HcpVaultSecretResourceParameterNames.PROJECT_ID, - HCP_PROJECT_ID), - new ResourceParameter(HcpVaultSecretResourceParameterNames.APP_NAME, - HCP_APP_NAME), - new ResourceParameter(HcpVaultSecretResourceParameterNames.CLIENT_ID, - HCP_CLIENT_ID), - new ResourceParameter(HcpVaultSecretResourceParameterNames.CLIENT_SECRET, - HCP_CLIENT_SECRET), - new ResourceParameter(HcpVaultSecretResourceParameterNames.CREDENTIALS_FILE, - HCP_CREDENTIALS_FILE, DEFAULT_CREDENTIALS_FILE_PATH), - }; - - protected HcpVaultSecretResourceProvider(String resourceType, ResourceParameter... additionalParameters) { - super("hcpvault-secrets", resourceType, - Stream.concat( - Stream.of(PARAMETERS), - Stream.of(additionalParameters)) - .toArray(ResourceParameter[]::new)); - } - - private static HcpVaultAuthenticationMethod parseAuthenticationMethod(String method) { - switch (method) { - case "client-credentials": - return HcpVaultAuthenticationMethod.CLIENT_CREDENTIALS; - case "cli-credentials-file": - return HcpVaultAuthenticationMethod.CLI_CREDENTIALS_FILE; - case "auto-detect": - return HcpVaultAuthenticationMethod.AUTO_DETECT; - default: - throw new IllegalArgumentException("Unrecognized authentication method: " + method); - } - } - - @Override - protected String getEnvVariableForParameter(String paramName) { - switch (paramName) { - case HcpVaultSecretResourceParameterNames.ORG_ID: - return PARAM_HCP_ORG_ID; - case HcpVaultSecretResourceParameterNames.PROJECT_ID: - return PARAM_HCP_PROJECT_ID; - case HcpVaultSecretResourceParameterNames.APP_NAME: - return PARAM_HCP_APP_NAME; - case HcpVaultSecretResourceParameterNames.CLIENT_ID: - return PARAM_HCP_CLIENT_ID; - case HcpVaultSecretResourceParameterNames.CLIENT_SECRET: - return PARAM_HCP_CLIENT_SECRET; - case HcpVaultSecretResourceParameterNames.CREDENTIALS_FILE: - return PARAM_HCP_CREDENTIALS_FILE; - default: return paramName; - } - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretSEPSProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretSEPSProvider.java deleted file mode 100644 index 1bc7b0b8..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretSEPSProvider.java +++ /dev/null @@ -1,111 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.parameter.ParameterSet; -import oracle.jdbc.provider.resource.ResourceParameter; -import oracle.jdbc.provider.util.WalletUtils; -import oracle.jdbc.spi.OracleResourceProvider; -import oracle.jdbc.spi.PasswordProvider; -import oracle.jdbc.spi.UsernameProvider; - -import java.util.Base64; -import java.util.Map; - -import static oracle.jdbc.provider.util.CommonParameters.CONNECTION_STRING_INDEX; -import static oracle.jdbc.provider.util.CommonParameters.PASSWORD; - -/** - *

- * A provider for Secure External Password Store (SEPS) credentials used - * to establish secure authentication with an Oracle database. The wallet is - * retrieved from HCP Vault Secrets, where it is stored as a base64-encoded string. - *

- *

- * This provider supports retrieving both **username** and **password** from - * the wallet. It can handle both **SSO** and **PKCS12**-based wallets. - *

- *

- * This class implements the {@link UsernameProvider} and - * {@link PasswordProvider} SPIs defined by Oracle JDBC and is designed to be - * instantiated via {@link java.util.ServiceLoader}. - *

- */ -public class HcpVaultSecretSEPSProvider - extends HcpVaultSecretProvider - implements UsernameProvider, PasswordProvider { - - private static final ResourceParameter[] SEPS_PARAMETERS = { - new ResourceParameter(HcpVaultSecretResourceParameterNames.WALLET_PASSWORD, - PASSWORD), - new ResourceParameter(HcpVaultSecretResourceParameterNames.CONNECTION_STRING_INDEX, - CONNECTION_STRING_INDEX) - }; - - /** - * A public no-arg constructor used by {@link java.util.ServiceLoader} to - * construct an instance of this provider. - */ - public HcpVaultSecretSEPSProvider() { - super("seps", SEPS_PARAMETERS); - } - - @Override - public String getUsername(Map parameterValues) { - return getWalletCredentials(parameterValues).username(); - } - - @Override - public char[] getPassword(Map parameterValues) { - return getWalletCredentials(parameterValues).password(); - } - - private WalletUtils.Credentials getWalletCredentials( - Map parameterValues) { - ParameterSet parameterSet = parseParameterValues(parameterValues); - byte[] walletBytes = Base64.getDecoder().decode(getSecret(parameterValues)); - - char[] walletPassword = parameterSet.getOptional(PASSWORD) != null - ? parameterSet.getOptional(PASSWORD).toCharArray() - : null; - - String connectionStringIndex = parameterSet.getOptional(CONNECTION_STRING_INDEX); - return WalletUtils.getCredentials(walletBytes, walletPassword, connectionStringIndex); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretTCPSProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretTCPSProvider.java deleted file mode 100644 index 3920d2d7..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretTCPSProvider.java +++ /dev/null @@ -1,106 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.parameter.ParameterSet; -import oracle.jdbc.provider.resource.ResourceParameter; -import oracle.jdbc.provider.util.TlsUtils; -import oracle.jdbc.spi.TlsConfigurationProvider; - -import javax.net.ssl.SSLContext; -import java.util.Base64; -import java.util.Map; - -import static oracle.jdbc.provider.util.CommonParameters.PASSWORD; -import static oracle.jdbc.provider.util.CommonParameters.TYPE; - -/** - *

- * A provider for TCPS/TLS files used to establish secure TLS communication - * with an Autonomous Database. The file is retrieved from HCP Vault Secrets, - * where it is stored as a base64-encoded string. This provider supports - * different file types including SSO, PKCS12, and PEM formats. - *

- *

- * The type of the file must be explicitly specified using the {@code type} - * parameter. Based on the type, the file may contain private keys and - * certificates for establishing secure communication. A password is only - * required for PKCS12 or encrypted PEM files. - *

- *

- * This class implements the {@link TlsConfigurationProvider} SPI defined by - * Oracle JDBC and is designed to be instantiated via - * {@link java.util.ServiceLoader}. - *

- */ -public class HcpVaultSecretTCPSProvider - extends HcpVaultSecretProvider - implements TlsConfigurationProvider { - - private static final ResourceParameter[] TCPS_PARAMETERS = { - new ResourceParameter(HcpVaultSecretResourceParameterNames.WALLET_PASSWORD, - PASSWORD), - new ResourceParameter(HcpVaultSecretResourceParameterNames.TYPE, TYPE) - }; - - /** - * A public no-arg constructor used by {@link java.util.ServiceLoader} to - * construct an instance of this provider. - */ - public HcpVaultSecretTCPSProvider() { - super("tls", TCPS_PARAMETERS); - } - - @Override - public SSLContext getSSLContext(Map parameterValues) { - try { - ParameterSet parameterSet = parseParameterValues(parameterValues); - byte[] fileBytes = Base64.getDecoder().decode(getSecret(parameterValues)); - - char[] password = parameterSet.getOptional(PASSWORD) != null - ? parameterSet.getOptional(PASSWORD).toCharArray() - : null; - - String type = parameterSet.getRequired(TYPE); - return TlsUtils.createSSLContext(fileBytes, password, type); - } catch (Exception e) { - throw new IllegalStateException("Failed to create SSLContext from the file", e); - } - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretUsernameProvider.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretUsernameProvider.java deleted file mode 100644 index c0d24dbf..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSecretUsernameProvider.java +++ /dev/null @@ -1,71 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.spi.UsernameProvider; - -import java.util.Map; - -/** - *

- * A provider for securely retrieving a username stored as a secret - * in HashiCorp HCP Vault Secrets. - *

- *

- * This class implements the {@link UsernameProvider} SPI defined by - * Oracle JDBC and is designed to be instantiated via {@link java.util.ServiceLoader}. - *

- */ -public class HcpVaultSecretUsernameProvider - extends HcpVaultSecretProvider - implements UsernameProvider { - - /** - * A public no-arg constructor used by {@link java.util.ServiceLoader} to - * construct an instance of this provider. - */ - public HcpVaultSecretUsernameProvider() { - super("username"); - } - - @Override - public String getUsername(Map parameterValues) { - return getSecret(parameterValues); - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultApiClient.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultApiClient.java deleted file mode 100644 index 330c5526..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultApiClient.java +++ /dev/null @@ -1,101 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.secrets; - -import oracle.jdbc.provider.hashicorp.util.HttpUtil; -import oracle.sql.json.OracleJsonException; -import oracle.sql.json.OracleJsonObject; - -import static oracle.jdbc.provider.hashicorp.util.JsonUtil.convertJsonToOracleJsonObject; - -/** - *

- * Utility class for interacting with the HCP Vault Secrets API. Provides - * methods to fetch secrets and extract specific fields from JSON responses. - *

- *

- * This class is responsible for making HTTP requests to the HCP Vault API - * and parsing the JSON responses using the Oracle JSON library. - *

- */ -public final class HcpVaultApiClient { - - private static final String SECRET_FIELD = "secret"; - private static final String STATIC_VERSION_FIELD = "static_version"; - private static final String VALUE_FIELD = "value"; - - private HcpVaultApiClient() { - } - - /** - * Fetches the secret value from the HCP Vault Secrets API. - *

- * The API response contains metadata along with the secret. The expected format is: - *

-   * {
-   *   "secret": {
-   *     "static_version": {
-   *       "value": "OUR_SECRET"
-   *     }
-   *   }
-   * }
-   * 
- * This method extracts and returns the `value` field. - * - * @param urlStr The HCP Vault API endpoint. - * @param token The Bearer token for authentication. - * @return The extracted secret value. Never null. - * @throws IllegalStateException If the request fails or JSON is invalid. - */ - public static String fetchSecret(String urlStr, String token) { - try { - String jsonResponse = HttpUtil.sendGetRequest(urlStr, token, null); - OracleJsonObject jsonObject = convertJsonToOracleJsonObject(jsonResponse); - - return jsonObject.getObject(SECRET_FIELD) - .getObject(STATIC_VERSION_FIELD) - .getString(VALUE_FIELD); - - } catch (OracleJsonException e) { - throw new IllegalStateException("Invalid JSON structure or missing fields in response", e); - } catch (Exception e) { - throw new IllegalStateException("Failed to fetch HCP secrets from URL: " + urlStr, e); - } - } -} diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultSecretsManagerFactory.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultSecretsManagerFactory.java deleted file mode 100644 index 3348a328..00000000 --- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/secrets/HcpVaultSecretsManagerFactory.java +++ /dev/null @@ -1,99 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.secrets; - -import oracle.jdbc.provider.cache.CachedResourceFactory; -import oracle.jdbc.provider.factory.Resource; -import oracle.jdbc.provider.factory.ResourceFactory; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultResourceFactory; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretToken; -import oracle.jdbc.provider.parameter.ParameterSet; - -import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*; - -/** - *

- * Factory for retrieving secrets from (HCP) Vault Secrets. - * Responsible for making API calls to the HCP Vault and parsing responses. - *

- *

- * The secrets API URL structure follows the format: - *

- *
- * {@code
- * https://api.cloud.hashicorp.com/secrets/2023-11-28/organizations/{ORG_ID}/projects/{PROJECT_ID}/apps/{APP_NAME}/secrets/{SECRET_NAME}:open
- * }
- * 
- *

- * For more details, refer to the official HCP Vault Secrets API documentation: - * - * Retrieve a Secret from HCP Vault Secrets - * - *

- */ -public final class HcpVaultSecretsManagerFactory extends HcpVaultResourceFactory { - - private static final String HCP_SECRETS_API_URL_FORMAT = - "https://api.cloud.hashicorp.com/secrets/2023-11-28/organizations/%s/projects/%s/apps/%s/secrets/%s:open"; - - - private static final ResourceFactory INSTANCE = - CachedResourceFactory.create(new HcpVaultSecretsManagerFactory()); - - private HcpVaultSecretsManagerFactory() {} - - public static ResourceFactory getInstance() { - return INSTANCE; - } - - @Override - public Resource request(HcpVaultSecretToken credentials, ParameterSet parameterSet) { - String orgId = parameterSet.getRequired(HCP_ORG_ID); - String projectId = parameterSet.getRequired(HCP_PROJECT_ID); - String appName = parameterSet.getRequired(HCP_APP_NAME); - String secretName = parameterSet.getRequired(SECRET_NAME); - - String hcpUrl = String.format(HCP_SECRETS_API_URL_FORMAT, orgId, projectId, appName, secretName); - - String secretsJson = HcpVaultApiClient.fetchSecret(hcpUrl, credentials.getHcpApiToken()); - - return Resource.createPermanentResource(secretsJson, true); - } - -} diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.ConnectionStringProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.ConnectionStringProvider index 4d20243a..41b28094 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.ConnectionStringProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.ConnectionStringProvider @@ -1,2 +1 @@ -oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedConnectionStringProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretConnectionStringProvider \ No newline at end of file +oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedConnectionStringProvider \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationProvider index 489b2cdd..5278cd4f 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationProvider @@ -1,2 +1 @@ -oracle.jdbc.provider.hashicorp.hcpvaultdedicated.configuration.DedicatedVaultSecretsManagerConfigurationProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration.HcpVaultSecretsManagerConfigurationProvider \ No newline at end of file +oracle.jdbc.provider.hashicorp.hcpvaultdedicated.configuration.DedicatedVaultSecretsManagerConfigurationProvider \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationSecretProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationSecretProvider index d29219b9..f4aca4ad 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationSecretProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.OracleConfigurationSecretProvider @@ -1,2 +1 @@ -oracle.jdbc.provider.hashicorp.hcpvaultdedicated.configuration.DedicatedVaultJsonSecretProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration.HcpVaultJsonVaultProvider \ No newline at end of file +oracle.jdbc.provider.hashicorp.hcpvaultdedicated.configuration.DedicatedVaultJsonSecretProvider \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.PasswordProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.PasswordProvider index a57a51ad..a06f28d6 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.PasswordProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.PasswordProvider @@ -1,4 +1,2 @@ oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedPasswordProvider oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedSEPSProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretPasswordProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretSEPSProvider diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.TlsConfigurationProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.TlsConfigurationProvider index b60fb543..fdbf2db3 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.TlsConfigurationProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.TlsConfigurationProvider @@ -1,2 +1 @@ -oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedTCPSProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretTCPSProvider \ No newline at end of file +oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedTCPSProvider \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.UsernameProvider b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.UsernameProvider index 7709bdb2..0a935a45 100644 --- a/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.UsernameProvider +++ b/ojdbc-provider-hashicorp/src/main/resources/META-INF/services/oracle.jdbc.spi.UsernameProvider @@ -1,4 +1,2 @@ oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedUsernameProvider -oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedSEPSProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretUsernameProvider -oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource.HcpVaultSecretSEPSProvider \ No newline at end of file +oracle.jdbc.provider.hashicorp.hcpvaultdedicated.resource.HcpVaultDedicatedSEPSProvider \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestProperty.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestProperty.java deleted file mode 100644 index 52f0c770..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestProperty.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret; - -/** - * Enumeration of test properties for HCP Vault. - */ -public enum HcpVaultTestProperty { - HCP_APP_NAME, - - HCP_ORG_ID, - - HCP_PROJECT_ID, - - HCP_CLIENT_ID, - - HCP_CLIENT_SECRET, - - SECRET_NAME, - - SECRET_NAME_WITH_MULTIPLE_KEYS, - - KEY, - - CONNECTION_STRING_BASE64, - - CONNECTION_STRING_PLAIN_TEXT, - - TNSNAMES_ALIAS, - - USERNAME_SECRET_NAME, - - WALLET_P12_SECRET_NAME, - - WALLET_PASSWORD, - - WALLET_SSO_SECRET_NAME, - - WALLET_PEM_SECRET_NAME, - - WALLET_SECRET_PKCS12_NAME, - - WALLET_SECRET_SSO_NAME, - - HCP_CREDENTIALS_FILE -} diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestUtil.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestUtil.java deleted file mode 100644 index 54fd0190..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultTestUtil.java +++ /dev/null @@ -1,97 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret; - -import oracle.jdbc.provider.TestProperties; -import org.junit.jupiter.api.Assumptions; - -import java.util.Map; - -/** - * Utility class for configuring authentication parameters in tests that verify - * implementations of {@link oracle.jdbc.spi.OracleResourceProvider} in the - * ojdbc-provider-hcpvault-secrets provider. - */ -public final class HcpVaultTestUtil { - - private HcpVaultTestUtil() { } - - public static void configureAuthentication(Map testParameters) { - testParameters.putIfAbsent("authenticationMethod", "auto-detect"); - String authMethod = testParameters.get("authenticationMethod"); - - switch (authMethod) { - case "client-credentials": - testParameters.put("clientId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_ID)); - testParameters.put("clientSecret", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_SECRET)); - break; - case "cli-credentials-file": - testParameters.put("credentialsFile", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CREDENTIALS_FILE)); - break; - case "auto-detect": - if (!configureAutoDetect(testParameters)) - Assumptions.abort("No valid authentication method found for auto-detect."); - break; - default: - throw new IllegalArgumentException("Unsupported authentication method: " + authMethod); - } - - testParameters.put("orgId", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - testParameters.put("projectId", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - testParameters.put("appName", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - } - - private static boolean configureAutoDetect(Map testParameters) { - return setIfAvailable(testParameters, "clientId", HcpVaultTestProperty.HCP_CLIENT_ID) && - setIfAvailable(testParameters, "clientSecret", HcpVaultTestProperty.HCP_CLIENT_SECRET) || - setIfAvailable(testParameters, "credentialsFile", HcpVaultTestProperty.HCP_CREDENTIALS_FILE); - } - - private static boolean setIfAvailable(Map testParameters, String key, HcpVaultTestProperty property) { - String value = TestProperties.getOptional(property); - if (value != null) { - testParameters.put(key, value); - return true; - } - return false; - } -} diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultConfigurationProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultConfigurationProviderTest.java deleted file mode 100644 index afc05f9b..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/HcpVaultConfigurationProviderTest.java +++ /dev/null @@ -1,194 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.OracleConfigurationProvider; -import org.junit.jupiter.api.BeforeAll; -import org.junit.jupiter.api.Disabled; -import org.junit.jupiter.api.Test; - -import java.sql.SQLException; -import java.util.ArrayList; -import java.util.List; -import java.util.Properties; - -import static org.junit.jupiter.api.Assertions.assertTrue; - -/** - * Test class for the HCP Vault Configuration Provider. - */ -public class HcpVaultConfigurationProviderTest { - - static { - OracleConfigurationProvider.allowedProviders.add("hcpvaultsecret"); - } - - private static final OracleConfigurationProvider PROVIDER = - OracleConfigurationProvider.find("hcpvaultsecret"); - - @BeforeAll - public static void setUp() { - System.setProperty("HCP_ORG_ID", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - System.setProperty("HCP_PROJECT_ID", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - System.setProperty("HCP_APP_NAME", - TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - - } - - /** - * Verifies if HCP Vault Configuration Provider works with - * CLIENT_CREDENTIALS authentication. - * Without Key Option - */ - @Test - public void testClientCredentialsAuthentication() throws SQLException { - // Load parameters from TestProperties - String baseUrl = TestProperties.getOrAbort(HcpVaultTestProperty.SECRET_NAME); - String clientId = "HCP_CLIENT_ID=" + TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_ID); - String clientSecret = "HCP_CLIENT_SECRET=" + TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_SECRET); - // Compose the connection URL - String location = composeUrl(baseUrl, clientId, clientSecret); - - // Fetch properties using the provider - Properties properties = PROVIDER.getConnectionProperties(location); - - // Assert required properties - assertTrue(properties.containsKey("URL"), "Contains property URL"); - assertTrue(properties.containsKey("user"), "Contains property user"); - assertTrue(properties.containsKey("password"), "Contains property password"); - } - - /** - * Verifies if HCP Vault Configuration Provider works with - * CLIENT_CREDENTIALS authentication. - * With Key Option - */ - @Test - public void testClientCredentialsAuthenticationWithKeyOption() throws SQLException { - // Load parameters from TestProperties - String baseUrl = TestProperties.getOrAbort(HcpVaultTestProperty.SECRET_NAME_WITH_MULTIPLE_KEYS); - String clientId = "HCP_CLIENT_ID=" + TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_ID); - String clientSecret = "HCP_CLIENT_SECRET=" + TestProperties.getOrAbort(HcpVaultTestProperty.HCP_CLIENT_SECRET); - String authMethod = "authentication=CLIENT_CREDENTIALS"; - String key = "key=" + TestProperties.getOrAbort(HcpVaultTestProperty.KEY); - // Compose the connection URL - String location = composeUrl(baseUrl, clientId, clientSecret, key, authMethod); - - // Fetch properties using the provider - Properties properties = PROVIDER.getConnectionProperties(location); - - // Assert required properties - assertTrue(properties.containsKey("URL"), "Contains property URL"); - assertTrue(properties.containsKey("user"), "Contains property user"); - assertTrue(properties.containsKey("password"), "Contains property password"); - } - - - /** - * Verifies if HCP Vault Configuration Provider works with - * CLI_CREDENTIALS_FILE authentication. - * With Key Option - */ - @Test - @Disabled - public void testCLICredentialsFileAuthenticationWithKeyOption() throws SQLException { - // Load parameters from TestProperties - String baseUrl = TestProperties.getOrAbort(HcpVaultTestProperty.SECRET_NAME_WITH_MULTIPLE_KEYS); - String key = "key=" + TestProperties.getOrAbort(HcpVaultTestProperty.KEY); - String authMethod = "authentication=CLI_CREDENTIALS_FILE"; - // Compose the connection URL - String location = composeUrl(baseUrl, key, authMethod); - - // Fetch properties using the provider - Properties properties = PROVIDER.getConnectionProperties(location); - - // Assert required properties - assertTrue(properties.containsKey("URL"), "Contains property URL"); - assertTrue(properties.containsKey("user"), "Contains property user"); - assertTrue(properties.containsKey("password"), "Contains property password"); - } - - /** - * Verifies if the HCP Vault Configuration Provider works with - * AUTO_DETECT authentication (with the key option). - */ - @Test - public void testAutoDetectAuthenticationWithKeyOption() throws SQLException { - List params = new ArrayList<>(); - String baseUrl = TestProperties.getOrAbort(HcpVaultTestProperty.SECRET_NAME_WITH_MULTIPLE_KEYS); - String key = "key=" + TestProperties.getOrAbort(HcpVaultTestProperty.KEY); - params.add(key); - // Construct optional authentication parameters - String clientId = - TestProperties.getOptional(HcpVaultTestProperty.HCP_CLIENT_ID); - String clientSecret = - TestProperties.getOptional(HcpVaultTestProperty.HCP_CLIENT_SECRET); - if(clientId!=null && clientSecret!=null) { - params.add("HCP_CLIENT_ID=" + clientId); - params.add("HCP_CLIENT_SECRET=" + clientSecret); - } - String credentialsFile = - TestProperties.getOptional(HcpVaultTestProperty.HCP_CREDENTIALS_FILE); - if(credentialsFile!=null) { - params.add("HCP_CREDENTIALS_FILE=" + credentialsFile); - } - - // Compose the connection URL - String location = composeUrl(baseUrl, params.toArray(new String[0])); - - // Fetch properties using the provider - Properties properties = PROVIDER.getConnectionProperties(location); - - // Assert required properties - assertTrue(properties.containsKey("URL"), "Contains property URL"); - assertTrue(properties.containsKey("user"), "Contains property user"); - assertTrue(properties.containsKey("password"), "Contains property password"); - } - - /** - * Composes a full URL from a base URL and query options. - */ - private static String composeUrl(String baseUrl, String... options) { - return String.format("%s?%s", baseUrl, String.join("&", options)); - } -} diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultConnectionStringProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultConnectionStringProviderTest.java deleted file mode 100644 index d6caac48..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultConnectionStringProviderTest.java +++ /dev/null @@ -1,140 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestUtil; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.ConnectionStringProvider; -import oracle.jdbc.spi.OracleResourceProvider.Parameter; -import org.junit.jupiter.api.Test; - -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.createParameterValues; -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.findProvider; -import static org.junit.jupiter.api.Assertions.*; - -public class HcpVaultConnectionStringProviderTest { - - private static final ConnectionStringProvider PROVIDER = - findProvider(ConnectionStringProvider.class, "ojdbc-provider-hcpvault-secrets-tnsnames"); - - - /** - * Verifies that {@link ConnectionStringProvider#getParameters()} includes parameters - * to configure authentication and secret retrieval. - */ - @Test - public void testGetParameters() { - Collection parameters = PROVIDER.getParameters(); - assertNotNull(parameters); - - Parameter secretNameParameter = - parameters.stream() - .filter(parameter -> "secretName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(secretNameParameter.isRequired()); - assertNull(secretNameParameter.defaultValue()); - - Parameter tnsAliasParameter = - parameters.stream() - .filter(parameter -> "tnsAlias".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(tnsAliasParameter.isRequired()); - assertNull(tnsAliasParameter.defaultValue()); - - Parameter orgIdParameter = - parameters.stream() - .filter(parameter -> "orgId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(orgIdParameter.defaultValue()); - - Parameter appNameParameter = - parameters.stream() - .filter(parameter -> "appName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(appNameParameter.defaultValue()); - - Parameter projectIdParameter = - parameters.stream() - .filter(parameter -> "projectId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(projectIdParameter.defaultValue()); - } - - @Test - public void testRetrieveConnectionStringFromBase64Encoded() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.CONNECTION_STRING_BASE64)); - testParams.put("tnsAlias", TestProperties.getOrAbort(HcpVaultTestProperty.TNSNAMES_ALIAS)); - testParams.put("orgId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - testParams.put("projectId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - testParams.put("appName", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - String connectionString = PROVIDER.getConnectionString(values); - - assertNotNull(connectionString); - } - - @Test - public void testRetrieveConnectionStringFromPlainText() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.CONNECTION_STRING_PLAIN_TEXT)); - testParams.put("tnsAlias", TestProperties.getOrAbort(HcpVaultTestProperty.TNSNAMES_ALIAS)); - testParams.put("orgId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - testParams.put("projectId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - testParams.put("appName", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - String connectionString = PROVIDER.getConnectionString(values); - - assertNotNull(connectionString); - } -} diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultPasswordProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultPasswordProviderTest.java deleted file mode 100644 index 225f6b8f..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultPasswordProviderTest.java +++ /dev/null @@ -1,116 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestUtil; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.OracleResourceProvider.Parameter; -import oracle.jdbc.spi.PasswordProvider; -import oracle.jdbc.spi.UsernameProvider; -import org.junit.jupiter.api.Test; - -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.createParameterValues; -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.findProvider; -import static org.junit.jupiter.api.Assertions.*; - -public class HcpVaultPasswordProviderTest { - - private static final PasswordProvider PROVIDER = - findProvider(PasswordProvider.class, "ojdbc-provider-hcpvault-secrets-password"); - - - /** - * Verifies that {@link UsernameProvider#getParameters()} includes parameters - * to configure authentication and secret retrieval. - */ - @Test - public void testGetParameters() { - Collection parameters = PROVIDER.getParameters(); - assertNotNull(parameters); - - Parameter secretNameParameter = - parameters.stream() - .filter(parameter -> "secretName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(secretNameParameter.isRequired()); - assertNull(secretNameParameter.defaultValue()); - - Parameter orgIdParameter = - parameters.stream() - .filter(parameter -> "orgId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(orgIdParameter.defaultValue()); - - Parameter appNameParameter = - parameters.stream() - .filter(parameter -> "appName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(appNameParameter.defaultValue()); - - Parameter projectIdParameter = - parameters.stream() - .filter(parameter -> "projectId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(projectIdParameter.defaultValue()); - } - - @Test - public void testRetrievePassword() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.USERNAME_SECRET_NAME)); - testParams.put("orgId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - testParams.put("projectId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - testParams.put("appName", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - char[] password = PROVIDER.getPassword(values); - - assertNotNull(password); - } -} diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSEPSProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSEPSProviderTest.java deleted file mode 100644 index 74ed77eb..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultSEPSProviderTest.java +++ /dev/null @@ -1,161 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestUtil; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.OracleResourceProvider.Parameter; -import oracle.jdbc.spi.PasswordProvider; -import oracle.jdbc.spi.UsernameProvider; -import org.junit.jupiter.api.Test; - -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.createParameterValues; -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.findProvider; -import static org.junit.jupiter.api.Assertions.*; - -public class HcpVaultSEPSProviderTest { - - private static final UsernameProvider USERNAME_PROVIDER = findProvider( - UsernameProvider.class, "ojdbc-provider-hcpvault-secrets-seps"); - - private static final PasswordProvider PASSWORD_PROVIDER = findProvider( - PasswordProvider.class, "ojdbc-provider-hcpvault-secrets-seps"); - - @Test - public void testGetusernameParams() { - Collection usernameParams = USERNAME_PROVIDER.getParameters(); - Collection passwordParams = PASSWORD_PROVIDER.getParameters(); - - assertEquals(usernameParams, passwordParams); - - Parameter secretNameParameter = - usernameParams.stream() - .filter(parameter -> "secretName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(secretNameParameter.isRequired()); - assertNull(secretNameParameter.defaultValue()); - - Parameter orgIdParameter = - usernameParams.stream() - .filter(parameter -> "orgId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(orgIdParameter.defaultValue()); - - Parameter appNameParameter = - usernameParams.stream() - .filter(parameter -> "appName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(appNameParameter.defaultValue()); - - Parameter projectIdParameter = - usernameParams.stream() - .filter(parameter -> "projectId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(projectIdParameter.defaultValue()); - - - Parameter walletPasswordParameter = - usernameParams.stream() - .filter(parameter -> "walletPassword".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(walletPasswordParameter.isSensitive()); - assertFalse(walletPasswordParameter.isRequired()); - assertNull(walletPasswordParameter.defaultValue()); - } - - @Test - public void testRetrieveUsernameFromPKCS12() { - Map params = new HashMap<>(); - params.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_SECRET_PKCS12_NAME)); - params.put("walletPassword", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PASSWORD)); - HcpVaultTestUtil.configureAuthentication(params); - - Map values = createParameterValues(USERNAME_PROVIDER, params); - String username = USERNAME_PROVIDER.getUsername(values); - - assertNotNull(username); - } - - @Test - public void testRetrievePasswordFromPKCS12() { - Map params = new HashMap<>(); - params.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_SECRET_PKCS12_NAME)); - params.put("walletPassword", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PASSWORD)); - HcpVaultTestUtil.configureAuthentication(params); - - Map values = createParameterValues(PASSWORD_PROVIDER, params); - char[] password = PASSWORD_PROVIDER.getPassword(values); - assertNotNull(password); - } - - @Test - public void testRetrieveUsernameFromSSO() { - Map params = new HashMap<>(); - params.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_SECRET_SSO_NAME)); - HcpVaultTestUtil.configureAuthentication(params); - - Map values = createParameterValues(USERNAME_PROVIDER, params); - String username = USERNAME_PROVIDER.getUsername(values); - - assertNotNull(username); - } - - @Test - public void testRetrievePasswordFromSSO() { - Map params = new HashMap<>(); - params.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_SECRET_SSO_NAME)); - HcpVaultTestUtil.configureAuthentication(params); - - Map values = createParameterValues(PASSWORD_PROVIDER, params); - char[] password = PASSWORD_PROVIDER.getPassword(values); - - assertNotNull(password); - } - -} \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultTCPSProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultTCPSProviderTest.java deleted file mode 100644 index 9cebbc60..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultTCPSProviderTest.java +++ /dev/null @@ -1,173 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestUtil; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.OracleResourceProvider.Parameter; -import oracle.jdbc.spi.TlsConfigurationProvider; -import org.junit.jupiter.api.Test; - -import javax.net.ssl.SSLContext; -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.createParameterValues; -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.findProvider; -import static org.junit.jupiter.api.Assertions.*; - -public class HcpVaultTCPSProviderTest { - - private static final TlsConfigurationProvider PROVIDER = findProvider( - TlsConfigurationProvider.class, "ojdbc-provider-hcpvault-secrets-tls"); - - @Test - public void testGetParameters() { - Collection parameters = PROVIDER.getParameters(); - assertNotNull(parameters); - - Parameter secretNameParameter = - parameters.stream() - .filter(parameter -> "secretName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(secretNameParameter.isRequired()); - assertNull(secretNameParameter.defaultValue()); - - Parameter orgIdParameter = - parameters.stream() - .filter(parameter -> "orgId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(orgIdParameter.defaultValue()); - - Parameter appNameParameter = - parameters.stream() - .filter(parameter -> "appName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(appNameParameter.defaultValue()); - - Parameter projectIdParameter = - parameters.stream() - .filter(parameter -> "projectId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(projectIdParameter.defaultValue()); - - Parameter typeParameter = - parameters.stream() - .filter(parameter -> "type".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(typeParameter.isRequired()); - assertNull(typeParameter.defaultValue()); - - Parameter walletPasswordParameter = - parameters.stream() - .filter(parameter -> "walletPassword".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(walletPasswordParameter.isSensitive()); - assertFalse(walletPasswordParameter.isRequired()); - assertNull(walletPasswordParameter.defaultValue()); - } - - @Test - public void testRetrieveSSLContextFromPKCS12() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_P12_SECRET_NAME)); - testParams.put("type", "PKCS12"); - testParams.put("walletPassword", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PASSWORD)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - SSLContext context = PROVIDER.getSSLContext(values); - assertNotNull(context); - } - - @Test - public void testRetrieveSSLContextFromSSO() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_SSO_SECRET_NAME)); - testParams.put("type", "SSO"); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - SSLContext context = PROVIDER.getSSLContext(values); - assertNotNull(context); - } - - @Test - public void testRetrieveSSLContextFromPEM() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PEM_SECRET_NAME)); - testParams.put("type", "PEM"); - testParams.put("walletPassword", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PASSWORD)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - SSLContext context = PROVIDER.getSSLContext(values); - assertNotNull(context); - } - - @Test - public void testMissingPasswordForPKCS12() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_P12_SECRET_NAME)); - testParams.put("type", "PKCS12"); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - assertThrows(IllegalStateException.class, () -> PROVIDER.getSSLContext(values)); - } - - @Test - public void testMissingPasswordForPEM() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.WALLET_PEM_SECRET_NAME)); - testParams.put("type", "PEM"); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - assertThrows(IllegalStateException.class, () -> PROVIDER.getSSLContext(values)); - } -} \ No newline at end of file diff --git a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultUsernameProviderTest.java b/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultUsernameProviderTest.java deleted file mode 100644 index 1df00740..00000000 --- a/ojdbc-provider-hashicorp/src/test/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/HcpVaultUsernameProviderTest.java +++ /dev/null @@ -1,115 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.provider.TestProperties; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestUtil; -import oracle.jdbc.provider.hashicorp.hcpvaultsecret.HcpVaultTestProperty; -import oracle.jdbc.spi.OracleResourceProvider.Parameter; -import oracle.jdbc.spi.UsernameProvider; -import org.junit.jupiter.api.Test; - -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; - -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.createParameterValues; -import static oracle.jdbc.provider.resource.ResourceProviderTestUtil.findProvider; -import static org.junit.jupiter.api.Assertions.*; - -public class HcpVaultUsernameProviderTest { - - private static final UsernameProvider PROVIDER = - findProvider(UsernameProvider.class, "ojdbc-provider-hcpvault-secrets-username"); - - - /** - * Verifies that {@link UsernameProvider#getParameters()} includes parameters - * to configure authentication and secret retrieval. - */ - @Test - public void testGetParameters() { - Collection parameters = PROVIDER.getParameters(); - assertNotNull(parameters); - - Parameter secretNameParameter = - parameters.stream() - .filter(parameter -> "secretName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertTrue(secretNameParameter.isRequired()); - assertNull(secretNameParameter.defaultValue()); - - Parameter orgIdParameter = - parameters.stream() - .filter(parameter -> "orgId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(orgIdParameter.defaultValue()); - - Parameter appNameParameter = - parameters.stream() - .filter(parameter -> "appName".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(appNameParameter.defaultValue()); - - Parameter projectIdParameter = - parameters.stream() - .filter(parameter -> "projectId".equals(parameter.name())) - .findFirst() - .orElseThrow(AssertionError::new); - assertNull(projectIdParameter.defaultValue()); - } - - @Test - public void testRetrieveUsername() { - Map testParams = new HashMap<>(); - testParams.put("secretName", TestProperties.getOrAbort(HcpVaultTestProperty.USERNAME_SECRET_NAME)); - testParams.put("orgId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_ORG_ID)); - testParams.put("projectId", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_PROJECT_ID)); - testParams.put("appName", TestProperties.getOrAbort(HcpVaultTestProperty.HCP_APP_NAME)); - HcpVaultTestUtil.configureAuthentication(testParams); - - Map values = createParameterValues(PROVIDER, testParams); - String username = PROVIDER.getUsername(values); - - assertNotNull(username); - } -} diff --git a/ojdbc-provider-oci/README.md b/ojdbc-provider-oci/README.md index 75243bd1..e08d2fd3 100644 --- a/ojdbc-provider-oci/README.md +++ b/ojdbc-provider-oci/README.md @@ -163,7 +163,6 @@ For the JSON type of provider (OCI Object Storage, HTTPS, File) the password is - `base64` (Base64) - `awssecretsmanager` (AWS Secrets Manager) - `hcpvaultdedicated` (HCP Vault Dedicated) - - `hcpvaultsecret` (HCP Vault Secrets) - `value` - Mandatory - Possible values: @@ -173,7 +172,6 @@ For the JSON type of provider (OCI Object Storage, HTTPS, File) the password is - Base64 Encoded password (if base64) - AWS Secret name (if awssecretsmanager) - Secret path (if hcpvaultdedicated) - - Secret name (if hcpvaultsecret) - `authentication` - Optional. It will apply defaults in the same way as described in [Configuring Authentication](#configuring-authentication) - Possible Values: diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/SimpleVaultSecretsJsonExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/SimpleVaultSecretsJsonExample.java deleted file mode 100644 index 4779bdfc..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/configuration/SimpleVaultSecretsJsonExample.java +++ /dev/null @@ -1,101 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.configuration; - -import oracle.jdbc.datasource.impl.OracleDataSource; -import oracle.jdbc.provider.Configuration; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; - -public class SimpleVaultSecretsJsonExample { - - /** - * The configuration parameter for the Vault application name. - *

- * This parameter should be set as a JVM system property, environment variable, - * or an entry in the configuration.properties file under the key - * "VAULT_APP_NAME". - *

- */ - private static final String VAULT_SECRET_NAME = Configuration.getRequired( - "VAULT_SECRET_NAME"); - - /** - *

- * Connects to a database using connection properties retrieved from the - * configured Vault application in HCP Vault Secrets. - *

- * - *

- * Ensure that the HCP Vault Secrets provider is properly configured, and the - * specified application name is valid and accessible. - *

- * - * @param args the command line arguments - * @throws SQLException if an error occurs during the database calls - */ - public static void main(String[] args) throws SQLException { - // Construct a JDBC URL for the dedicated type provider - String url = "jdbc:oracle:thin:@config-hcpvaultsecret://" + VAULT_SECRET_NAME; - - // Sample default URL if not provided in arguments - if (args.length > 0) { - url = args[0]; - } - - // Configure the data source - OracleDataSource ds = new OracleDataSource(); - ds.setURL(url); - - // Standard JDBC code - try (Connection cn = ds.getConnection()) { - System.out.println("Connected to: " + cn.getMetaData().getURL()); - - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("SELECT 'Hello, Vault Secrets' FROM sys" + - ".dual"); - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } -} diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleConnectionStringProviderExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleConnectionStringProviderExample.java deleted file mode 100644 index 8cdb82ce..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleConnectionStringProviderExample.java +++ /dev/null @@ -1,88 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - - -import oracle.jdbc.datasource.impl.OracleDataSource; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.Properties; - -/** - * Example demonstrating how to configure Oracle JDBC with the HCP Vault Secrets - * Connection String Provider to retrieve connection strings from a tnsnames.ora - * file stored in HCP Vault Secrets. - */ -public class SimpleConnectionStringProviderExample { - public static void main(String[] args) throws SQLException { - try { - OracleDataSource ds = new OracleDataSource(); - ds.setURL("jdbc:oracle:thin:@"); - ds.setUser("DB_USERNAME"); - ds.setPassword("DB_PASSWORD"); - - Properties connectionProps = new Properties(); - - // Connection String Provider for retrieving tnsnames.ora content - connectionProps.put("oracle.jdbc.provider.connectionString", - "ojdbc-provider-hcpvault-secrets-tnsnames"); - connectionProps.put("oracle.jdbc.provider.connectionString.secretName", - "secret-name"); - connectionProps.put("oracle.jdbc.provider.connectionString.tnsAlias", - "tns-alias"); - - ds.setConnectionProperties(connectionProps); - - try (Connection cn = ds.getConnection()) { - String query = "SELECT 'Hello, db' FROM sys.dual"; - try (Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery(query)) { - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } - } catch (SQLException e) { - throw new RuntimeException("Connection failed: ", e); - } - } -} \ No newline at end of file diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimplePasswordProviderExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimplePasswordProviderExample.java deleted file mode 100644 index 2e932dac..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimplePasswordProviderExample.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.datasource.impl.OracleDataSource; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.Properties; - -/** - * Example demonstrating how to use the HCP Vault Secrets Password Provider - * with Oracle JDBC to securely retrieve a database password from HCP Vault Secrets. - */ -public class SimplePasswordProviderExample { - private static final String DB_URL = "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=your_db_host))(connect_data=(service_name=your_service_name))(security=(ssl_server_dn_match=yes)))"; - private static final String JDBC_URL = "jdbc:oracle:thin:@" + DB_URL; - - public static void main(String[] args) throws SQLException { - try { - OracleDataSource ds = new OracleDataSource(); - ds.setURL(JDBC_URL); - ds.setUser("DB_USER"); - - Properties connectionProps = new Properties(); - connectionProps.put("oracle.jdbc.provider.password", "ojdbc-provider-hcpvault-secrets-password"); - connectionProps.put("oracle.jdbc.provider.password.secretName", "secret-password"); - - ds.setConnectionProperties(connectionProps); - - try (Connection cn = ds.getConnection()) { - String connectionString = cn.getMetaData().getURL(); - System.out.println("Connected to: " + connectionString); - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("SELECT 'Hello, db' FROM sys.dual"); - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } catch (SQLException e) { - throw new RuntimeException("Connection failed: ", e); - } - } -} \ No newline at end of file diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleSEPSWalletProviderExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleSEPSWalletProviderExample.java deleted file mode 100644 index b362be0a..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleSEPSWalletProviderExample.java +++ /dev/null @@ -1,84 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.datasource.impl.OracleDataSource; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.Properties; - -/** - * Example demonstrating how to configure Oracle JDBC with the HCP Vault Secrets - * SEPS Wallet Provider to retrieve database credentials from a Secure External - * Password Store (SEPS) wallet stored in HCP Vault Secrets. - */ -public class SimpleSEPSWalletProviderExample { - private static final String DB_URL = "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=your_db_host))(connect_data=(service_name=your_service_name))(security=(ssl_server_dn_match=yes)))"; - private static final String JDBC_URL = "jdbc:oracle:thin:@" + DB_URL; - - public static void main(String[] args) throws SQLException { - try { - OracleDataSource ds = new OracleDataSource(); - ds.setURL(JDBC_URL); - - Properties connectionProps = new Properties(); - connectionProps.put("oracle.jdbc.provider.username", "ojdbc-provider-hcpvault-secrets-seps"); - connectionProps.put("oracle.jdbc.provider.password", "ojdbc-provider-hcpvault-secrets-seps"); - connectionProps.put("oracle.jdbc.provider.username.secretName", "secret-name"); - connectionProps.put("oracle.jdbc.provider.password.secretName", "secret-name"); - - ds.setConnectionProperties(connectionProps); - - try (Connection cn = ds.getConnection()) { - String connectionString = cn.getMetaData().getURL(); - System.out.println("Connected to: " + connectionString); - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("SELECT 'Hello, db' FROM sys.dual"); - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } catch (SQLException e) { - throw new RuntimeException("Connection failed: ", e); - } - } -} \ No newline at end of file diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleTCPSWalletProviderExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleTCPSWalletProviderExample.java deleted file mode 100644 index 5658bfa1..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleTCPSWalletProviderExample.java +++ /dev/null @@ -1,89 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.datasource.impl.OracleDataSource; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.Properties; - -/** - * Example demonstrating how to configure Oracle JDBC with the HCP Vault Secrets - * TCPS Wallet Provider to establish a secure TLS connection using a wallet stored - * in HCP Vault Secrets. - */ -public class SimpleTCPSWalletProviderExample { - private static final String DB_URL = "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=your_db_host))(connect_data=(service_name=your_service_name))(security=(ssl_server_dn_match=yes)))"; - private static final String JDBC_URL = "jdbc:oracle:thin:@" + DB_URL; - private static final String USERNAME = "DB_USER"; - private static final String PASSWORD = "DB_PASSWORD"; - - public static void main(String[] args) throws SQLException { - try { - OracleDataSource ds = new OracleDataSource(); - ds.setURL(JDBC_URL); - ds.setUser(USERNAME); - ds.setPassword(PASSWORD); - - Properties connectionProps = new Properties(); - connectionProps.put("oracle.jdbc.provider.tlsConfiguration", - "ojdbc-provider-hcpvault-secrets-tls"); - connectionProps.put("oracle.jdbc.provider.tlsConfiguration.secretName", - "secret-name"); - connectionProps.put("oracle.jdbc.provider.tlsConfiguration.type", "SSO"); - - ds.setConnectionProperties(connectionProps); - - try (Connection cn = ds.getConnection()) { - String connectionString = cn.getMetaData().getURL(); - System.out.println("Connected to: " + connectionString); - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("SELECT 'Hello, db' FROM sys.dual"); - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } catch (SQLException e) { - throw new RuntimeException("Connection failed: ", e); - } - } -} \ No newline at end of file diff --git a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleUsernameProviderExample.java b/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleUsernameProviderExample.java deleted file mode 100644 index 1bf7eac3..00000000 --- a/ojdbc-provider-samples/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/resource/SimpleUsernameProviderExample.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - ** Copyright (c) 2025 Oracle and/or its affiliates. - ** - ** The Universal Permissive License (UPL), Version 1.0 - ** - ** Subject to the condition set forth below, permission is hereby granted to any - ** person obtaining a copy of this software, associated documentation and/or data - ** (collectively the "Software"), free of charge and under any and all copyright - ** rights in the Software, and any and all patent rights owned or freely - ** licensable by each licensor hereunder covering either (i) the unmodified - ** Software as contributed to or provided by such licensor, or (ii) the Larger - ** Works (as defined below), to deal in both - ** - ** (a) the Software, and - ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if - ** one is included with the Software (each a "Larger Work" to which the Software - ** is contributed by such licensors), - ** - ** without restriction, including without limitation the rights to copy, create - ** derivative works of, display, perform, and distribute the Software and make, - ** use, sell, offer for sale, import, export, have made, and have sold the - ** Software and the Larger Work(s), and to sublicense the foregoing rights on - ** either these or other terms. - ** - ** This license is subject to the following condition: - ** The above copyright notice and either this complete permission notice or at - ** a minimum a reference to the UPL must be included in all copies or - ** substantial portions of the Software. - ** - ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - ** SOFTWARE. - */ - -package oracle.jdbc.provider.hashicorp.hcpvaultsecret.resource; - -import oracle.jdbc.datasource.impl.OracleDataSource; - -import java.sql.Connection; -import java.sql.ResultSet; -import java.sql.SQLException; -import java.sql.Statement; -import java.util.Properties; - -/** - * Example demonstrating how to use the HCP Vault Secrets Username Provider - * with Oracle JDBC to securely retrieve a database username from HCP Vault Secrets. - */ -public class SimpleUsernameProviderExample { - private static final String DB_URL = "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=your_db_host))(connect_data=(service_name=your_service_name))(security=(ssl_server_dn_match=yes)))"; - private static final String JDBC_URL = "jdbc:oracle:thin:@" + DB_URL; - - public static void main(String[] args) throws SQLException { - try { - OracleDataSource ds = new OracleDataSource(); - ds.setURL(JDBC_URL); - ds.setPassword("DB_PASSWORD"); - - Properties connectionProps = new Properties(); - connectionProps.put("oracle.jdbc.provider.username", "ojdbc-provider-hcpvault-secrets-username"); - connectionProps.put("oracle.jdbc.provider.username.secretName", "secret-name"); - - ds.setConnectionProperties(connectionProps); - - try (Connection cn = ds.getConnection()) { - String connectionString = cn.getMetaData().getURL(); - System.out.println("Connected to: " + connectionString); - Statement st = cn.createStatement(); - ResultSet rs = st.executeQuery("SELECT 'Hello, db' FROM sys.dual"); - if (rs.next()) { - System.out.println(rs.getString(1)); - } - } - } catch (SQLException e) { - throw new RuntimeException("Connection failed: ", e); - } - } -} \ No newline at end of file