org.keycloak.vault

Class FilesPlainTextVaultProvider

java.lang.Object

org.keycloak.vault.FilesPlainTextVaultProvider

All Implemented Interfaces:

Provider, VaultProvider

public class FilesPlainTextVaultProvider
extends Object
implements VaultProvider

A text-based vault provider, which stores each secret in a separate file. The file name needs to match a vault secret id (or a key for short). A typical vault directory layout looks like this:

     ${VAULT}/realma__key1 (contains secret for key 1)
     ${VAULT}/realma__key2 (contains secret for key 2)
     etc...
 

Note, that each key needs is prefixed by realm name. This kind of layout is used by Kubernetes by default (when mounting a volume into the pod). See https://kubernetes.io/docs/concepts/configuration/secret/ See https://github.com/keycloak/keycloak-community/blob/master/design/secure-credentials-store.md#plain-text-file-per-secret-kubernetes--openshift

Author:

Sebastian Łaskawiec

Constructor Summary

Constructors

Constructor and Description
FilesPlainTextVaultProvider(Path path, String realmName) Creates a new FilesPlainTextVaultProvider.

Method Summary

Modifier and Type	Method and Description
void	close()
VaultRawSecret	obtainSecret(String vaultSecretId)
protected Path	resolveSecretPath(String vaultSecretId) A method that resolves the exact secret location.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

FilesPlainTextVaultProvider

public FilesPlainTextVaultProvider(@Nonnull
                                   Path path,
                                   @Nonnull
                                   String realmName)

Creates a new FilesPlainTextVaultProvider.

Parameters:

path - A path to a vault. Can not be null.

realmName - A realm name. Can not be null.

Method Detail

obtainSecret

public VaultRawSecret obtainSecret(String vaultSecretId)

Specified by:

obtainSecret in interface VaultProvider

close

public void close()

Specified by:

close in interface Provider

resolveSecretPath

protected Path resolveSecretPath(String vaultSecretId)

A method that resolves the exact secret location.

Parameters:

vaultSecretId - Secret ID.

Returns:

Path for the secret.