Add secure vault changes to EndpointConfigManager class.
@@ -24,12 +24,14 @@ import org.apache.commons.logging.LogFactory;
import org.wso2.carbon.identity.core.util.IdentityUtil;
import org.wso2.securevault.SecretResolver;
import org.wso2.securevault.SecretResolverFactory;
+import org.wso2.securevault.commons.MiscellaneousUtil;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.Enumeration;
+import java.util.Map;
import java.util.Properties;
import java.util.StringTokenizer;
@@ -67,11 +69,8 @@ public class EndpointConfigManager {
prop.load(inputStream);
- if (isSecuredPropertyAvailable(prop)) {
// Resolve encrypted properties with secure vault
resolveSecrets(prop);
- }
-
} else {
inputStream = EndpointConfigManager.class.getClassLoader()
.getResourceAsStream(Constants.TenantConstants.CONFIG_FILE_NAME);
@@ -188,28 +187,35 @@ public class EndpointConfigManager {
*/
private static void resolveSecrets(Properties properties) {
- String protectedTokens = (String) properties.get(PROTECTED_TOKENS);
-
- if (StringUtils.isNotBlank(protectedTokens)) {
String secretProvider = (String) properties.get(SECRET_PROVIDER);
- SecretResolver secretResolver;
-
if (StringUtils.isBlank(secretProvider)) {
properties.put(SECRET_PROVIDER, DEFAULT_CALLBACK_HANDLER);
}
+ SecretResolver secretResolver = SecretResolverFactory.create(properties);
+ if (secretResolver != null && secretResolver.isInitialized()) {
+ for (Map.Entry<Object, Object> entry : properties.entrySet()) {
+ String key = entry.getKey().toString();
+ String value = entry.getValue().toString();
+ if (value != null) {
+ value = MiscellaneousUtil.resolve(value, secretResolver);
+ }
+ properties.put(key, value);
+ }
+ }
+ // Support the protectedToken alias used for encryption. ProtectedToken alias is deprecated
+ if (isSecuredPropertyAvailable(properties)) {
+ SecretResolver resolver = SecretResolverFactory.create(properties, "");
+ String protectedTokens = (String) properties.get(PROTECTED_TOKENS);
+ StringTokenizer st = new StringTokenizer(protectedTokens, ",");
+ while (st.hasMoreElements()) {
+ String element = st.nextElement().toString().trim();
- secretResolver = SecretResolverFactory.create(properties, "");
- StringTokenizer stringTokenizer = new StringTokenizer(protectedTokens, ",");
-
- while (stringTokenizer.hasMoreElements()) {
- String element = stringTokenizer.nextElement().toString().trim();
-
- if (secretResolver.isTokenProtected(element)) {
+ if (resolver.isTokenProtected(element)) {
if (log.isDebugEnabled()) {
log.debug("Resolving and replacing secret for " + element);
}
// Replaces the original encrypted property with resolved property
- properties.put(element, secretResolver.resolve(element));
+ properties.put(element, resolver.resolve(element));
} else {
if (log.isDebugEnabled()) {
log.debug("No encryption done for value with key :" + element);
