credentialProvider;
+
+ /**
+ * {@inheritDoc}
+ *
+ * Azure Key Vault allows strictly a-z, A-Z, 0-9, and "-". This
+ * implementation strips out all contiguous groups of characters which are
+ * not allowed by Azure Key Vault, replacing them with a single dash.
+ */
+ @Override
+ public String canonicalize(String name) {
+ Matcher disallowed = DISALLOWED_CHARACTERS.matcher(name);
+ return disallowed.replaceAll("-");
+ }
+
+ @Override
+ public String getValue(String name) throws GuacamoleException {
+
+ try {
+
+ // Retrieve configuration information necessary for connecting to
+ // Azure Key Vault
+ String url = confService.getVaultURL();
+ KeyVaultCredentials credentials = credentialProvider.get();
+
+ // Authenticate against Azure Key Vault
+ KeyVaultClient client = new KeyVaultClient(credentials);
+
+ // Retrieve requested secret
+ SecretBundle secret = client.getSecret(url, name);
+
+ // FIXME: STUB
+ return null;
+
+ }
+ catch (AzureKeyVaultAuthenticationException e) {
+ throw new GuacamoleServerException("Unable to authenticate with Azure.", e);
+ }
+
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-azure/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-azure/src/main/resources/guac-manifest.json
new file mode 100644
index 000000000..87e1b1165
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-azure/src/main/resources/guac-manifest.json
@@ -0,0 +1,16 @@
+{
+
+ "guacamoleVersion" : "1.4.0",
+
+ "name" : "Azure Key Vault",
+ "namespace" : "azure-keyvault",
+
+ "authProviders" : [
+ "org.apache.guacamole.auth.vault.azure.AzureKeyVaultAuthenticationProvider"
+ ],
+
+ "translations" : [
+ "translations/en.json"
+ ]
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/.ratignore b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/.ratignore
new file mode 100644
index 000000000..e69de29bb
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/pom.xml b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/pom.xml
new file mode 100644
index 000000000..d59754fe6
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/pom.xml
@@ -0,0 +1,70 @@
+
+
+
+
+ 4.0.0
+ org.apache.guacamole
+ guacamole-auth-vault-base
+ jar
+ guacamole-auth-vault-base
+ http://guacamole.apache.org/
+
+
+ UTF-8
+
+
+
+ org.apache.guacamole
+ guacamole-auth-vault
+ 1.4.0
+ ../../
+
+
+
+
+
+
+ org.apache.guacamole
+ guacamole-ext
+ provided
+
+
+
+
+ com.fasterxml.jackson.core
+ jackson-databind
+
+
+
+
+ com.google.inject
+ guice
+
+
+ com.google.inject.extensions
+ guice-assistedinject
+
+
+
+
+
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProvider.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProvider.java
new file mode 100644
index 000000000..0b9126a67
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProvider.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault;
+
+import com.google.inject.Guice;
+import com.google.inject.Injector;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.vault.user.VaultUserContextFactory;
+import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.UserContext;
+
+/**
+ * AuthenticationProvider implementation which automatically injects tokens
+ * containing the values of secrets retrieved from a vault.
+ */
+public abstract class VaultAuthenticationProvider
+ extends AbstractAuthenticationProvider {
+
+ /**
+ * Factory for creating instances of the relevant vault-specific
+ * UserContext implementation.
+ */
+ private final VaultUserContextFactory userContextFactory;
+
+ /**
+ * Creates a new VaultAuthenticationProvider which uses the given module to
+ * configure dependency injection.
+ *
+ * @param module
+ * The module to use to configure dependency injection.
+ */
+ protected VaultAuthenticationProvider(VaultAuthenticationProviderModule module) {
+ Injector injector = Guice.createInjector(module);
+ this.userContextFactory = injector.getInstance(VaultUserContextFactory.class);
+ }
+
+ @Override
+ public UserContext decorate(UserContext context,
+ AuthenticatedUser authenticatedUser, Credentials credentials)
+ throws GuacamoleException {
+ return userContextFactory.create(context);
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProviderModule.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProviderModule.java
new file mode 100644
index 000000000..9e5ae7155
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/VaultAuthenticationProviderModule.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault;
+
+import com.google.inject.AbstractModule;
+import com.google.inject.assistedinject.FactoryModuleBuilder;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.vault.user.VaultUserContext;
+import org.apache.guacamole.auth.vault.user.VaultUserContextFactory;
+import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.environment.LocalEnvironment;
+import org.apache.guacamole.net.auth.UserContext;
+
+/**
+ * Guice module which configures injections specific to the base support for
+ * key vaults. When adding support for a key vault provider, a subclass
+ * specific to that vault implementation will need to be created.
+ *
+ * @see AzureKeyVaultAuthenticationProviderModule
+ */
+public abstract class VaultAuthenticationProviderModule extends AbstractModule {
+
+ /**
+ * Guacamole server environment.
+ */
+ private final Environment environment;
+
+ /**
+ * Creates a new VaultAuthenticationProviderModule which configures
+ * dependency injection for the Azure Key Vault authentication provider.
+ *
+ * @throws GuacamoleException
+ * If an error occurs while retrieving the Guacamole server
+ * environment.
+ */
+ public VaultAuthenticationProviderModule() throws GuacamoleException {
+ this.environment = LocalEnvironment.getInstance();
+ }
+
+ /**
+ * Configures injections for interfaces which are implementation-specific
+ * to the vault service in use. Subclasses MUST provide a version of this
+ * function which binds concrete implementations to the following
+ * interfaces:
+ *
+ * - VaultConfigurationService
+ * - VaultSecretService
+ *
+ * @see AzureKeyVaultAuthenticationProviderModule
+ */
+ protected abstract void configureVault();
+
+ /**
+ * Returns the instance of the Guacamole server environment which will be
+ * exposed to other classes via dependency injection.
+ *
+ * @return
+ * The instance of the Guacamole server environment which will be
+ * exposed via dependency injection.
+ */
+ protected Environment getEnvironment() {
+ return environment;
+ }
+
+ @Override
+ protected void configure() {
+
+ // Bind Guacamole server environment
+ bind(Environment.class).toInstance(environment);
+
+ // Bind factory for creating UserContexts
+ install(new FactoryModuleBuilder()
+ .implement(UserContext.class, VaultUserContext.class)
+ .build(VaultUserContextFactory.class));
+
+ // Bind all other implementation-specific interfaces
+ configureVault();
+
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/conf/VaultConfigurationService.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/conf/VaultConfigurationService.java
new file mode 100644
index 000000000..9cafbd45f
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/conf/VaultConfigurationService.java
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault.conf;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.inject.Inject;
+import java.io.File;
+import java.io.IOException;
+import java.util.Map;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.auth.vault.VaultAuthenticationProviderModule;
+import org.apache.guacamole.environment.Environment;
+
+/**
+ * Base class for services which retrieve key vault configuration information.
+ * A concrete implementation of this class must be defined and bound for key
+ * vault support to work.
+ *
+ * @see VaultAuthenticationProviderModule
+ */
+public abstract class VaultConfigurationService {
+
+ /**
+ * The Guacamole server environment.
+ */
+ @Inject
+ private Environment environment;
+
+ /**
+ * ObjectMapper for deserializing JSON.
+ */
+ private static final ObjectMapper mapper = new ObjectMapper();
+
+ /**
+ * The name of the file containing a JSON mapping of Guacamole parameter
+ * token to vault secret name.
+ */
+ private final String tokenMappingFilename;
+
+ /**
+ * Creates a new VaultConfigurationService which retrieves the token/secret
+ * mapping from a JSON file having the given name.
+ *
+ * @param tokenMappingFilename
+ * The name of the JSON file containing the token/secret mapping.
+ */
+ protected VaultConfigurationService(String tokenMappingFilename) {
+ this.tokenMappingFilename = tokenMappingFilename;
+ }
+
+ /**
+ * Returns a mapping dictating the name of the secret which maps to each
+ * parameter token. In the returned mapping, the value of each entry is the
+ * name of the secret to use to populate the value of the parameter token,
+ * and the key of each entry is the name of the parameter token which
+ * should receive the value of the secret.
+ *
+ * The name of the secret may contain its own tokens, which will be
+ * substituted using values from the given filter. See the definition of
+ * VaultUserContext for the names of these tokens and the contexts in which
+ * they can be applied to secret names.
+ *
+ * @return
+ * A mapping dictating the name of the secret which maps to each
+ * parameter token.
+ *
+ * @throws GuacamoleException
+ * If the JSON file defining the token/secret mapping cannot be read.
+ */
+ public Map getTokenMapping() throws GuacamoleException {
+
+ // Get configuration file from GUACAMOLE_HOME
+ File confFile = new File(environment.getGuacamoleHome(), tokenMappingFilename);
+
+ // Deserialize token mapping from JSON
+ try {
+ return mapper.readValue(confFile, new TypeReference>() {});
+ }
+
+ // Fail if JSON is invalid/unreadable
+ catch (IOException e) {
+ throw new GuacamoleServerException("Unable to read token mapping "
+ + "configuration file \"" + tokenMappingFilename + "\".", e);
+ }
+
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/secret/VaultSecretService.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/secret/VaultSecretService.java
new file mode 100644
index 000000000..49d0d9ce3
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/secret/VaultSecretService.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault.secret;
+
+import org.apache.guacamole.GuacamoleException;
+
+/**
+ * Generic service for retrieving the value of a secret stored in a vault.
+ */
+public interface VaultSecretService {
+
+ /**
+ * Translates an arbitrary string, which may contain characters not allowed
+ * by the vault implementation, into a string which is a valid secret name.
+ * The type of transformation performed on the string, if any, will depend
+ * on the specific requirements of the vault provider.
+ *
+ * NOTE: It is critical that this transformation is deterministic and
+ * reasonably predictable for users. If an implementation must apply a
+ * transformation to secret names, that transformation needs to be
+ * documented.
+ *
+ * @param name
+ * An arbitrary string intended for use as a secret name, but which may
+ * contain characters not allowed by the vault implementation.
+ *
+ * @return
+ * A name containing essentially the same content as the provided
+ * string, but transformed deterministically such that it is acceptable
+ * as a secret name by the vault provider.
+ */
+ String canonicalize(String name);
+
+ /**
+ * Returns the value of the secret having the given name. If no such
+ * secret exists, null is returned.
+ *
+ * @param name
+ * The name of the secret to retrieve.
+ *
+ * @return
+ * The value of the secret having the given name, or null if no such
+ * secret exists.
+ *
+ * @throws GuacamoleException
+ * If the secret cannot be retrieved due to an error.
+ */
+ String getValue(String name) throws GuacamoleException;
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContext.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContext.java
new file mode 100644
index 000000000..13cb6d515
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContext.java
@@ -0,0 +1,281 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault.user;
+
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.google.inject.assistedinject.AssistedInject;
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.vault.conf.VaultConfigurationService;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.TokenInjectingUserContext;
+import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.auth.vault.secret.VaultSecretService;
+import org.apache.guacamole.protocol.GuacamoleConfiguration;
+import org.apache.guacamole.token.GuacamoleTokenUndefinedException;
+import org.apache.guacamole.token.TokenFilter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * UserContext implementation which automatically injects tokens containing the
+ * values of secrets retrieved from a vault.
+ */
+public class VaultUserContext extends TokenInjectingUserContext {
+
+ /**
+ * Logger for this class.
+ */
+ private final Logger logger = LoggerFactory.getLogger(VaultUserContext.class);
+
+ /**
+ * The name of the token which will be replaced with the username of the
+ * current user if specified within the name of a secret. This token
+ * applies to both connections and connection groups.
+ */
+ private static final String USERNAME_TOKEN = "GUAC_USERNAME";
+
+ /**
+ * The name of the token which will be replaced with the name of the
+ * current connection group if specified within the name of a secret. This
+ * token only applies only to connection groups.
+ */
+ private static final String CONNECTION_GROUP_NAME_TOKEN = "CONNECTION_GROUP_NAME";
+
+ /**
+ * The name of the token which will be replaced with the identifier of the
+ * current connection group if specified within the name of a secret. This
+ * token only applies only to connection groups.
+ */
+ private static final String CONNECTION_GROUP_IDENTIFIER_TOKEN = "CONNECTION_GROUP_ID";
+
+ /**
+ * The name of the token which will be replaced with the \"hostname\"
+ * connection parameter of the current connection if specified within the
+ * name of a secret. This token only applies only to connections.
+ */
+ private static final String CONNECTION_HOSTNAME_TOKEN = "CONNECTION_HOSTNAME";
+
+ /**
+ * The name of the token which will be replaced with the \"username\"
+ * connection parameter of the current connection if specified within the
+ * name of a secret. This token only applies only to connections.
+ */
+ private static final String CONNECTION_USERNAME_TOKEN = "CONNECTION_USERNAME";
+
+ /**
+ * The name of the token which will be replaced with the name of the
+ * current connection if specified within the name of a secret. This token
+ * only applies only to connections.
+ */
+ private static final String CONNECTION_NAME_TOKEN = "CONNECTION_NAME";
+
+ /**
+ * The name of the token which will be replaced with the identifier of the
+ * current connection if specified within the name of a secret. This token
+ * only applies only to connections.
+ */
+ private static final String CONNECTION_IDENTIFIER_TOKEN = "CONNECTION_ID";
+
+ /**
+ * Service for retrieving configuration information.
+ */
+ @Inject
+ private VaultConfigurationService confService;
+
+ /**
+ * Service for retrieving the values of secrets stored in a vault.
+ */
+ @Inject
+ private VaultSecretService secretService;
+
+ /**
+ * Creates a new VaultUserContext which automatically injects tokens
+ * containing values of secrets retrieved from a vault. The given
+ * UserContext is decorated such that connections and connection groups
+ * will receive additional tokens during the connection process.
+ *
+ * Note that this class depends on concrete implementations of the
+ * following classes to be provided via dependency injection:
+ *
+ * - VaultConfigurationService
+ * - VaultSecretService
+ *
+ * Bindings providing these concrete implementations will need to be
+ * provided by subclasses of VaultAuthenticationProviderModule for each
+ * supported vault.
+ *
+ * @param userContext
+ * The UserContext instance to decorate.
+ */
+ @AssistedInject
+ public VaultUserContext(@Assisted UserContext userContext) {
+ super(userContext);
+ }
+
+ /**
+ * Creates a new TokenFilter instance with token values set for all tokens
+ * which are not specific to connections or connection groups. Currently,
+ * this is only the username token ("GUAC_USERNAME").
+ *
+ * @return
+ * A new TokenFilter instance with token values set for all tokens
+ * which are not specific to connections or connection groups.
+ */
+ private TokenFilter createFilter() {
+ TokenFilter filter = new TokenFilter();
+ filter.setToken(USERNAME_TOKEN, self().getIdentifier());
+ return filter;
+ }
+
+ /**
+ * Retrieve all applicable tokens and corresponding values from the vault,
+ * using the given TokenFilter to filter tokens within the secret names
+ * prior to retrieving those secrets.
+ *
+ * @param tokenMapping
+ * The mapping dictating the name of the secret which maps to each
+ * parameter token, where the key is the name of the parameter token
+ * and the value is the name of the secret. The name of the secret
+ * may contain its own tokens, which will be substituted using values
+ * from the given filter.
+ *
+ * @param filter
+ * The filter to use to substitute values for tokens in the names of
+ * secrets to be retrieved from the vault.
+ *
+ * @return
+ * The tokens which should be added to the in-progress call to
+ * connect().
+ *
+ * @throws GuacamoleException
+ * If the value for any applicable secret cannot be retrieved from the
+ * vault due to an error.
+ */
+ private Map getTokens(Map tokenMapping,
+ TokenFilter filter) throws GuacamoleException {
+
+ Map tokens = new HashMap<>();
+
+ // Populate map with tokens containing the values of all secrets
+ // indicated in the token mapping
+ for (Map.Entry entry : tokenMapping.entrySet()) {
+
+ // Translate secret pattern into secret name, ignoring any
+ // secrets which cannot be translated
+ String secretName;
+ try {
+ secretName = secretService.canonicalize(filter.filterStrict(entry.getValue()));
+ }
+ catch (GuacamoleTokenUndefinedException e) {
+ logger.debug("Secret for token \"{}\" will not be retrieved. "
+ + "Token \"{}\" within mapped secret name has no "
+ + "defined value in the current context.",
+ entry.getKey(), e.getTokenName());
+ continue;
+ }
+
+ // If a value is defined for the secret in question, store that
+ // value under the mapped token
+ String tokenName = entry.getKey();
+ String secretValue = secretService.getValue(secretName);
+ if (secretValue != null) {
+ tokens.put(tokenName, secretValue);
+ logger.debug("Token \"{}\" populated with value from "
+ + "secret \"{}\".", tokenName, secretName);
+ }
+ else
+ logger.debug("Token \"{}\" not populated. Mapped "
+ + "secret \"{}\" has no value.",
+ tokenName, secretName);
+
+ }
+
+ return tokens;
+
+ }
+
+ @Override
+ protected Map getTokens(ConnectionGroup connectionGroup)
+ throws GuacamoleException {
+
+ String name = connectionGroup.getName();
+ String identifier = connectionGroup.getIdentifier();
+ logger.debug("Injecting tokens from vault for connection group "
+ + "\"{}\" (\"{}\").", identifier, name);
+
+ // Add general and connection-group-specific tokens
+ TokenFilter filter = createFilter();
+ filter.setToken(CONNECTION_GROUP_NAME_TOKEN, name);
+ filter.setToken(CONNECTION_GROUP_IDENTIFIER_TOKEN, identifier);
+
+ // Substitute tokens producing secret names, retrieving and storing
+ // those secrets as parameter tokens
+ return getTokens(confService.getTokenMapping(), filter);
+
+ }
+
+ @Override
+ protected Map getTokens(Connection connection)
+ throws GuacamoleException {
+
+ String name = connection.getName();
+ String identifier = connection.getIdentifier();
+ logger.debug("Injecting tokens from vault for connection \"{}\" "
+ + "(\"{}\").", identifier, name);
+
+ // Add general and connection-specific tokens
+ TokenFilter filter = createFilter();
+ filter.setToken(CONNECTION_NAME_TOKEN, connection.getName());
+ filter.setToken(CONNECTION_IDENTIFIER_TOKEN, identifier);
+
+ // Add hostname and username tokens if available (implementations are
+ // not required to expose connection configuration details)
+
+ GuacamoleConfiguration config = connection.getConfiguration();
+
+ String hostname = config.getParameter("hostname");
+ if (hostname != null)
+ filter.setToken(CONNECTION_HOSTNAME_TOKEN, hostname);
+ else
+ logger.debug("Hostname for connection \"{}\" (\"{}\") not "
+ + "available. \"{}\" token will not be populated in "
+ + "secret names.", identifier, name,
+ CONNECTION_HOSTNAME_TOKEN);
+
+ String username = config.getParameter("username");
+ if (username != null)
+ filter.setToken(CONNECTION_USERNAME_TOKEN, username);
+ else
+ logger.debug("Username for connection \"{}\" (\"{}\") not "
+ + "available. \"{}\" token will not be populated in "
+ + "secret names.", identifier, name,
+ CONNECTION_USERNAME_TOKEN);
+
+ // Substitute tokens producing secret names, retrieving and storing
+ // those secrets as parameter tokens
+ return getTokens(confService.getTokenMapping(), filter);
+
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContextFactory.java b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContextFactory.java
new file mode 100644
index 000000000..712d41a9b
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/java/org/apache/guacamole/auth/vault/user/VaultUserContextFactory.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.vault.user;
+
+import org.apache.guacamole.net.auth.UserContext;
+
+/**
+ * Factory for creating UserContext instances which automatically inject tokens
+ * containing the values of secrets retrieved from a vault.
+ */
+public interface VaultUserContextFactory {
+
+ /**
+ * Returns a new instance of a UserContext implementation which
+ * automatically injects tokens containing values of secrets retrieved from
+ * a vault. The given UserContext is decorated such that connections and
+ * connection groups will receive additional tokens during the connection
+ * process.
+ *
+ * @param userContext
+ * The UserContext instance to decorate.
+ *
+ * @return
+ * A new UserContext instance which automatically injects tokens
+ * containing values of secrets retrieved from a vault.
+ */
+ UserContext create(UserContext userContext);
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/resources/translations/en.json
new file mode 100644
index 000000000..c96ec2821
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-base/src/main/resources/translations/en.json
@@ -0,0 +1,7 @@
+{
+
+ "DATA_SOURCE_AZURE_KEYVAULT" : {
+ "NAME" : "Azure Key Vault"
+ }
+
+}
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/.ratignore b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/.ratignore
new file mode 100644
index 000000000..e69de29bb
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/pom.xml b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/pom.xml
new file mode 100644
index 000000000..b239f28bf
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/pom.xml
@@ -0,0 +1,63 @@
+
+
+
+
+ 4.0.0
+ org.apache.guacamole
+ guacamole-auth-vault-dist
+ pom
+ guacamole-auth-vault-dist
+ http://guacamole.apache.org/
+
+
+ UTF-8
+
+
+
+ org.apache.guacamole
+ guacamole-auth-vault
+ 1.4.0
+ ../../
+
+
+
+
+
+
+ org.apache.guacamole
+ guacamole-auth-vault-azure
+ 1.4.0
+
+
+
+
+
+
+
+ ${project.parent.artifactId}-${project.parent.version}
+
+
+
+
diff --git a/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/src/main/assembly/dist.xml b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/src/main/assembly/dist.xml
new file mode 100644
index 000000000..b0ea3b1f6
--- /dev/null
+++ b/extensions/guacamole-auth-vault/modules/guacamole-auth-vault-dist/src/main/assembly/dist.xml
@@ -0,0 +1,54 @@
+
+
+
+
+ dist
+ ${project.parent.artifactId}-${project.parent.version}
+
+
+
+ tar.gz
+
+
+
+
+
+
+
+ azure
+
+ org.apache.guacamole:guacamole-auth-vault-azure
+
+
+
+
+
+
+
+
+
+ target/licenses
+
+
+
+
diff --git a/extensions/guacamole-auth-vault/pom.xml b/extensions/guacamole-auth-vault/pom.xml
new file mode 100644
index 000000000..a924af8b3
--- /dev/null
+++ b/extensions/guacamole-auth-vault/pom.xml
@@ -0,0 +1,67 @@
+
+
+
+
+ 4.0.0
+ org.apache.guacamole
+ guacamole-auth-vault
+ pom
+ 1.4.0
+ guacamole-auth-vault
+ http://guacamole.apache.org/
+
+
+ org.apache.guacamole
+ extensions
+ 1.4.0
+ ../
+
+
+
+
+
+ modules/guacamole-auth-vault-dist
+
+
+ modules/guacamole-auth-vault-base
+
+
+ modules/guacamole-auth-vault-azure
+
+
+
+
+
+
+
+
+ org.apache.guacamole
+ guacamole-ext
+ 1.4.0
+ provided
+
+
+
+
+
+
diff --git a/extensions/pom.xml b/extensions/pom.xml
index 938e7cc62..18e307e54 100644
--- a/extensions/pom.xml
+++ b/extensions/pom.xml
@@ -48,6 +48,7 @@
guacamole-auth-quickconnect
guacamole-auth-sso
guacamole-auth-totp
+ guacamole-auth-vault
diff --git a/pom.xml b/pom.xml
index bcfa885ad..2b9b1641f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -209,8 +209,8 @@
1.8
-Xlint:all
- -Werror
+ true
true
@@ -382,6 +382,11 @@
jackson-dataformat-yaml
${jackson.version}
+
+ com.fasterxml.jackson.datatype
+ jackson-datatype-joda
+ ${jackson.version}
+
com.fasterxml.jackson.module
jackson-module-jaxb-annotations