如何通过LDAP认证方式将Spring Boot应用连接至Enterprise Vault

Alright, let's get your Spring app connected to Enterprise Vault using LDAP authentication. You're right that Spring Cloud Vault doesn't expose out-of-the-box configuration properties like it does for Token or AppRole, but we can build a custom setup to make this work smoothly.

Step 1: Add Required Dependencies #

First, make sure you have the necessary dependencies in your project. For Maven, add these to your pom.xml:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-vault-config</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-ldap</artifactId>
</dependency>

For Gradle, add this to your build.gradle:

implementation 'org.springframework.cloud:spring-cloud-starter-vault-config'
implementation 'org.springframework.security:spring-security-ldap'

Step 2: Create a Custom Vault Configuration Class #

We'll extend Spring's AbstractVaultConfiguration to define our LDAP authentication flow. This class handles authenticating with Vault using your LDAP credentials and fetching a valid Vault token.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.vault.authentication.ClientAuthentication;
import org.springframework.vault.authentication.LdapAuthentication;
import org.springframework.vault.authentication.LdapAuthenticationOptions;
import org.springframework.vault.client.VaultEndpoint;
import org.springframework.vault.config.AbstractVaultConfiguration;
import org.springframework.beans.factory.annotation.Value;

@Configuration
public class VaultLdapAuthenticationConfig extends AbstractVaultConfiguration {

    @Value("${spring.cloud.vault.uri}")
    private String vaultUri;

    @Value("${ldap.username}")
    private String ldapUsername;

    @Value("${ldap.password}")
    private String ldapPassword;

    @Value("${spring.cloud.vault.auth.path:ldap}")
    private String ldapAuthPath;

    @Override
    public VaultEndpoint vaultEndpoint() {
        // Parse the Vault URI to create the endpoint
        return VaultEndpoint.from(vaultUri);
    }

    @Override
    public ClientAuthentication clientAuthentication() {
        // Build LDAP authentication options
        LdapAuthenticationOptions ldapOptions = LdapAuthenticationOptions.builder()
                .username(ldapUsername)
                .password(ldapPassword)
                .path(ldapAuthPath)
                .build();

        // Create and return the LDAP authentication provider
        return LdapAuthentication.create(vaultOperations(), ldapOptions);
    }
}

Step 3: Configure Application Properties #

Add these properties to your application.properties (or application.yml) to set up Vault basics and your LDAP credentials:

# Vault core configuration
spring.cloud.vault.uri=https://your-enterprise-vault-url:8200
spring.cloud.vault.namespace=admin
spring.cloud.vault.ssl.enabled=true # Set to false if your Vault doesn't use SSL (not recommended)

# LDAP credentials (store these securely in production, e.g., environment variables or a secrets manager)
ldap.username=your-ldap-user@your-domain.com
ldap.password=your-ldap-password
# Optional: override if your Vault uses a custom LDAP auth path
# spring.cloud.vault.auth.path=custom-ldap-path

Key Notes & Best Practices #

• Secure Credentials: Never hardcode LDAP credentials in your codebase. In production, use environment variables, Spring Cloud Config, or a dedicated secrets manager to inject these values.
• Vault LDAP Setup: Ensure your Enterprise Vault instance has the LDAP authentication method enabled and configured correctly. The LDAP auth path in your code should match the path you used when enabling LDAP in Vault (default is ldap).
• Namespace Awareness: The spring.cloud.vault.namespace property ensures all Vault operations (including authentication) are routed to the correct namespace in your Enterprise Vault deployment.
• SSL Configuration: If your Vault uses a custom SSL certificate, you may need to add spring.cloud.vault.ssl.trust-store and related properties to trust the certificate.

Once this setup is in place, your Spring app will automatically authenticate with Vault using LDAP on startup, and you can use Spring Cloud Vault's features (like secret retrieval) just as you would with Token or AppRole authentication.

内容的提问来源于stack exchange，提问作者Pramendra Raghuwanshi