|
36 | 36 | import java.util.stream.Collectors; |
37 | 37 |
|
38 | 38 | public class EncryptionAtRestController extends AuthenticatedController { |
39 | | - public static final Logger LOG = LoggerFactory.getLogger(EncryptionAtRestController.class); |
40 | | - |
41 | | - @Inject |
42 | | - EncryptionAtRestManager keyManager; |
43 | | - |
44 | | - @Inject |
45 | | - Commissioner commissioner; |
46 | | - |
47 | | - public Result createKMSConfig(UUID customerUUID, String keyProvider) { |
48 | | - LOG.info(String.format( |
49 | | - "Creating KMS configuration for customer %s with %s", |
50 | | - customerUUID.toString(), |
51 | | - keyProvider |
52 | | - )); |
53 | | - Customer customer = Customer.getOrBadRequest(customerUUID); |
54 | | - try { |
55 | | - TaskType taskType = TaskType.CreateKMSConfig; |
56 | | - ObjectNode formData = (ObjectNode) request().body().asJson(); |
57 | | - KMSConfigTaskParams taskParams = new KMSConfigTaskParams(); |
58 | | - taskParams.kmsProvider = Enum.valueOf(KeyProvider.class, keyProvider); |
59 | | - taskParams.providerConfig = formData; |
60 | | - taskParams.customerUUID = customerUUID; |
61 | | - taskParams.kmsConfigName = formData.get("name").asText(); |
62 | | - formData.remove("name"); |
63 | | - UUID taskUUID = commissioner.submit(taskType, taskParams); |
64 | | - LOG.info("Submitted create KMS config for {}, task uuid = {}.", customerUUID, taskUUID); |
65 | | - // Add this task uuid to the user universe. |
66 | | - CustomerTask.create(customer, |
67 | | - customerUUID, |
68 | | - taskUUID, |
69 | | - CustomerTask.TargetType.KMSConfiguration, |
70 | | - CustomerTask.TaskType.Create, |
71 | | - taskParams.getName()); |
72 | | - LOG.info("Saved task uuid " + taskUUID + " in customer tasks table for customer: " + |
73 | | - customerUUID); |
74 | | - |
75 | | - auditService().createAuditEntry(ctx(), request(), formData); |
76 | | - return new YWResults.YWTask(taskUUID).asResult(); |
77 | | - } catch (Exception e) { |
78 | | - throw new YWServiceException(BAD_REQUEST, e.getMessage()); |
79 | | - } |
| 39 | + public static final Logger LOG = LoggerFactory.getLogger(EncryptionAtRestController.class); |
| 40 | + |
| 41 | + @Inject EncryptionAtRestManager keyManager; |
| 42 | + |
| 43 | + @Inject Commissioner commissioner; |
| 44 | + |
| 45 | + public Result createKMSConfig(UUID customerUUID, String keyProvider) { |
| 46 | + LOG.info( |
| 47 | + String.format( |
| 48 | + "Creating KMS configuration for customer %s with %s", |
| 49 | + customerUUID.toString(), keyProvider)); |
| 50 | + Customer customer = Customer.getOrBadRequest(customerUUID); |
| 51 | + try { |
| 52 | + TaskType taskType = TaskType.CreateKMSConfig; |
| 53 | + ObjectNode formData = (ObjectNode) request().body().asJson(); |
| 54 | + KMSConfigTaskParams taskParams = new KMSConfigTaskParams(); |
| 55 | + taskParams.kmsProvider = Enum.valueOf(KeyProvider.class, keyProvider); |
| 56 | + taskParams.providerConfig = formData; |
| 57 | + taskParams.customerUUID = customerUUID; |
| 58 | + taskParams.kmsConfigName = formData.get("name").asText(); |
| 59 | + formData.remove("name"); |
| 60 | + UUID taskUUID = commissioner.submit(taskType, taskParams); |
| 61 | + LOG.info("Submitted create KMS config for {}, task uuid = {}.", customerUUID, taskUUID); |
| 62 | + // Add this task uuid to the user universe. |
| 63 | + CustomerTask.create( |
| 64 | + customer, |
| 65 | + customerUUID, |
| 66 | + taskUUID, |
| 67 | + CustomerTask.TargetType.KMSConfiguration, |
| 68 | + CustomerTask.TaskType.Create, |
| 69 | + taskParams.getName()); |
| 70 | + LOG.info( |
| 71 | + "Saved task uuid " + taskUUID + " in customer tasks table for customer: " + customerUUID); |
| 72 | + |
| 73 | + auditService().createAuditEntry(ctx(), request(), formData); |
| 74 | + return new YWResults.YWTask(taskUUID).asResult(); |
| 75 | + } catch (Exception e) { |
| 76 | + throw new YWServiceException(BAD_REQUEST, e.getMessage()); |
80 | 77 | } |
| 78 | + } |
81 | 79 |
|
82 | | - public Result getKMSConfig(UUID customerUUID, UUID configUUID) { |
83 | | - LOG.info(String.format( |
84 | | - "Retrieving KMS configuration %s", |
85 | | - configUUID.toString() |
86 | | - )); |
87 | | - KmsConfig config = KmsConfig.get(configUUID); |
88 | | - ObjectNode kmsConfig = keyManager.getServiceInstance(config.keyProvider.name()) |
89 | | - .getAuthConfig(configUUID); |
90 | | - if (kmsConfig == null) { |
91 | | - throw new YWServiceException(BAD_REQUEST, String.format( |
92 | | - "No KMS configuration found for config %s", |
93 | | - configUUID.toString() |
94 | | - )); |
95 | | - } |
96 | | - return ApiResponse.success(kmsConfig); |
| 80 | + public Result getKMSConfig(UUID customerUUID, UUID configUUID) { |
| 81 | + LOG.info(String.format("Retrieving KMS configuration %s", configUUID.toString())); |
| 82 | + KmsConfig config = KmsConfig.get(configUUID); |
| 83 | + ObjectNode kmsConfig = |
| 84 | + keyManager.getServiceInstance(config.keyProvider.name()).getAuthConfig(configUUID); |
| 85 | + if (kmsConfig == null) { |
| 86 | + throw new YWServiceException( |
| 87 | + BAD_REQUEST, |
| 88 | + String.format("No KMS configuration found for config %s", configUUID.toString())); |
97 | 89 | } |
| 90 | + return ApiResponse.success(kmsConfig); |
| 91 | + } |
98 | 92 |
|
99 | 93 | public Result listKMSConfigs(UUID customerUUID) { |
100 | 94 | LOG.info(String.format("Listing KMS configurations for customer %s", customerUUID.toString())); |
@@ -130,120 +124,108 @@ public Result listKMSConfigs(UUID customerUUID) { |
130 | 124 | return ApiResponse.success(kmsConfigs); |
131 | 125 | } |
132 | 126 |
|
133 | | - public Result deleteKMSConfig(UUID customerUUID, UUID configUUID) { |
134 | | - LOG.info(String.format( |
135 | | - "Deleting KMS configuration %s for customer %s", |
136 | | - configUUID.toString(), |
137 | | - customerUUID.toString() |
138 | | - )); |
139 | | - Customer customer = Customer.getOrBadRequest(customerUUID); |
140 | | - try { |
141 | | - KmsConfig config = KmsConfig.get(configUUID); |
142 | | - TaskType taskType = TaskType.DeleteKMSConfig; |
143 | | - KMSConfigTaskParams taskParams = new KMSConfigTaskParams(); |
144 | | - taskParams.kmsProvider = config.keyProvider; |
145 | | - taskParams.customerUUID = customerUUID; |
146 | | - taskParams.configUUID = configUUID; |
147 | | - UUID taskUUID = commissioner.submit(taskType, taskParams); |
148 | | - LOG.info("Submitted delete KMS config for {}, task uuid = {}.", customerUUID, taskUUID); |
149 | | - |
150 | | - // Add this task uuid to the user universe. |
151 | | - CustomerTask.create(customer, |
152 | | - customerUUID, |
153 | | - taskUUID, |
154 | | - CustomerTask.TargetType.KMSConfiguration, |
155 | | - CustomerTask.TaskType.Delete, |
156 | | - taskParams.getName()); |
157 | | - LOG.info("Saved task uuid " + taskUUID + " in customer tasks table for customer: " + |
158 | | - customerUUID); |
159 | | - auditService().createAuditEntry(ctx(), request()); |
160 | | - return new YWResults.YWTask(taskUUID).asResult(); |
161 | | - } catch (Exception e) { |
162 | | - throw new YWServiceException(BAD_REQUEST, e.getMessage()); |
163 | | - } |
| 127 | + public Result deleteKMSConfig(UUID customerUUID, UUID configUUID) { |
| 128 | + LOG.info( |
| 129 | + String.format( |
| 130 | + "Deleting KMS configuration %s for customer %s", |
| 131 | + configUUID.toString(), customerUUID.toString())); |
| 132 | + Customer customer = Customer.getOrBadRequest(customerUUID); |
| 133 | + try { |
| 134 | + KmsConfig config = KmsConfig.get(configUUID); |
| 135 | + TaskType taskType = TaskType.DeleteKMSConfig; |
| 136 | + KMSConfigTaskParams taskParams = new KMSConfigTaskParams(); |
| 137 | + taskParams.kmsProvider = config.keyProvider; |
| 138 | + taskParams.customerUUID = customerUUID; |
| 139 | + taskParams.configUUID = configUUID; |
| 140 | + UUID taskUUID = commissioner.submit(taskType, taskParams); |
| 141 | + LOG.info("Submitted delete KMS config for {}, task uuid = {}.", customerUUID, taskUUID); |
| 142 | + |
| 143 | + // Add this task uuid to the user universe. |
| 144 | + CustomerTask.create( |
| 145 | + customer, |
| 146 | + customerUUID, |
| 147 | + taskUUID, |
| 148 | + CustomerTask.TargetType.KMSConfiguration, |
| 149 | + CustomerTask.TaskType.Delete, |
| 150 | + taskParams.getName()); |
| 151 | + LOG.info( |
| 152 | + "Saved task uuid " + taskUUID + " in customer tasks table for customer: " + customerUUID); |
| 153 | + auditService().createAuditEntry(ctx(), request()); |
| 154 | + return new YWResults.YWTask(taskUUID).asResult(); |
| 155 | + } catch (Exception e) { |
| 156 | + throw new YWServiceException(BAD_REQUEST, e.getMessage()); |
164 | 157 | } |
| 158 | + } |
165 | 159 |
|
166 | | - public Result retrieveKey(UUID customerUUID, UUID universeUUID) { |
167 | | - LOG.info(String.format( |
168 | | - "Retrieving universe key for universe %s", |
169 | | - customerUUID.toString(), |
170 | | - universeUUID.toString() |
171 | | - )); |
172 | | - ObjectNode formData = (ObjectNode) request().body().asJson(); |
173 | | - byte[] keyRef = Base64.getDecoder().decode(formData.get("reference").asText()); |
174 | | - UUID configUUID = UUID.fromString(formData.get("configUUID").asText()); |
175 | | - byte[] recoveredKey = getRecoveredKeyOrBadRequest( |
176 | | - universeUUID, |
177 | | - configUUID, |
178 | | - keyRef |
179 | | - ); |
180 | | - ObjectNode result = Json.newObject() |
181 | | - .put("reference", keyRef) |
182 | | - .put("value", Base64.getEncoder().encodeToString(recoveredKey)); |
183 | | - auditService().createAuditEntry(ctx(), request(), formData); |
184 | | - return ApiResponse.success(result); |
185 | | - } |
| 160 | + public Result retrieveKey(UUID customerUUID, UUID universeUUID) { |
| 161 | + LOG.info( |
| 162 | + String.format( |
| 163 | + "Retrieving universe key for universe %s", |
| 164 | + customerUUID.toString(), universeUUID.toString())); |
| 165 | + ObjectNode formData = (ObjectNode) request().body().asJson(); |
| 166 | + byte[] keyRef = Base64.getDecoder().decode(formData.get("reference").asText()); |
| 167 | + UUID configUUID = UUID.fromString(formData.get("configUUID").asText()); |
| 168 | + byte[] recoveredKey = getRecoveredKeyOrBadRequest(universeUUID, configUUID, keyRef); |
| 169 | + ObjectNode result = |
| 170 | + Json.newObject() |
| 171 | + .put("reference", keyRef) |
| 172 | + .put("value", Base64.getEncoder().encodeToString(recoveredKey)); |
| 173 | + auditService().createAuditEntry(ctx(), request(), formData); |
| 174 | + return ApiResponse.success(result); |
| 175 | + } |
186 | 176 |
|
187 | | - public byte[] getRecoveredKeyOrBadRequest(UUID universeUUID, UUID configUUID, byte[] keyRef) { |
188 | | - byte[] recoveredKey = keyManager.getUniverseKey(universeUUID, configUUID, keyRef); |
189 | | - if (recoveredKey == null || recoveredKey.length == 0) { |
190 | | - final String errMsg = String.format( |
191 | | - "No universe key found for universe %s", |
192 | | - universeUUID.toString() |
193 | | - ); |
194 | | - throw new YWServiceException(BAD_REQUEST, errMsg); |
195 | | - } |
196 | | - return recoveredKey; |
| 177 | + public byte[] getRecoveredKeyOrBadRequest(UUID universeUUID, UUID configUUID, byte[] keyRef) { |
| 178 | + byte[] recoveredKey = keyManager.getUniverseKey(universeUUID, configUUID, keyRef); |
| 179 | + if (recoveredKey == null || recoveredKey.length == 0) { |
| 180 | + final String errMsg = |
| 181 | + String.format("No universe key found for universe %s", universeUUID.toString()); |
| 182 | + throw new YWServiceException(BAD_REQUEST, errMsg); |
197 | 183 | } |
| 184 | + return recoveredKey; |
| 185 | + } |
198 | 186 |
|
199 | | - public Result getKeyRefHistory(UUID customerUUID, UUID universeUUID) { |
200 | | - LOG.info(String.format( |
201 | | - "Retrieving key ref history for customer %s and universe %s", |
202 | | - customerUUID.toString(), |
203 | | - universeUUID.toString() |
204 | | - )); |
205 | | - return ApiResponse.success(KmsHistory.getAllTargetKeyRefs( |
206 | | - universeUUID, |
207 | | - KmsHistoryId.TargetType.UNIVERSE_KEY |
208 | | - ) |
209 | | - .stream() |
210 | | - .map(history -> { |
211 | | - return Json.newObject() |
212 | | - .put("reference", history.uuid.keyRef) |
213 | | - .put("configUUID", history.configUuid.toString()) |
214 | | - .put("timestamp", history.timestamp.toString()); |
215 | | - }) |
216 | | - .collect(Collectors.toList())); |
217 | | - } |
| 187 | + public Result getKeyRefHistory(UUID customerUUID, UUID universeUUID) { |
| 188 | + LOG.info( |
| 189 | + String.format( |
| 190 | + "Retrieving key ref history for customer %s and universe %s", |
| 191 | + customerUUID.toString(), universeUUID.toString())); |
| 192 | + return ApiResponse.success( |
| 193 | + KmsHistory.getAllTargetKeyRefs(universeUUID, KmsHistoryId.TargetType.UNIVERSE_KEY) |
| 194 | + .stream() |
| 195 | + .map( |
| 196 | + history -> { |
| 197 | + return Json.newObject() |
| 198 | + .put("reference", history.uuid.keyRef) |
| 199 | + .put("configUUID", history.configUuid.toString()) |
| 200 | + .put("timestamp", history.timestamp.toString()); |
| 201 | + }) |
| 202 | + .collect(Collectors.toList())); |
| 203 | + } |
218 | 204 |
|
219 | | - public Result removeKeyRefHistory(UUID customerUUID, UUID universeUUID) { |
220 | | - LOG.info(String.format( |
221 | | - "Removing key ref for customer %s with universe %s", |
222 | | - customerUUID.toString(), |
223 | | - universeUUID.toString() |
224 | | - )); |
225 | | - keyManager.cleanupEncryptionAtRest(customerUUID, universeUUID); |
226 | | - auditService().createAuditEntry(ctx(), request()); |
227 | | - return YWResults.YWSuccess.withMessage("Key ref was successfully removed"); |
228 | | - } |
| 205 | + public Result removeKeyRefHistory(UUID customerUUID, UUID universeUUID) { |
| 206 | + LOG.info( |
| 207 | + String.format( |
| 208 | + "Removing key ref for customer %s with universe %s", |
| 209 | + customerUUID.toString(), universeUUID.toString())); |
| 210 | + keyManager.cleanupEncryptionAtRest(customerUUID, universeUUID); |
| 211 | + auditService().createAuditEntry(ctx(), request()); |
| 212 | + return YWResults.YWSuccess.withMessage("Key ref was successfully removed"); |
| 213 | + } |
229 | 214 |
|
230 | | - public Result getCurrentKeyRef(UUID customerUUID, UUID universeUUID) { |
231 | | - LOG.info(String.format( |
232 | | - "Retrieving key ref for customer %s and universe %s", |
233 | | - customerUUID.toString(), |
234 | | - universeUUID.toString() |
235 | | - )); |
236 | | - KmsHistory activeKey = EncryptionAtRestUtil.getActiveKeyOrBadRequest(universeUUID); |
237 | | - String keyRef = activeKey.uuid.keyRef; |
238 | | - if (keyRef == null || keyRef.length() == 0) { |
239 | | - throw new YWServiceException(BAD_REQUEST, String.format( |
240 | | - "Could not retrieve key service for customer %s and universe %s", |
241 | | - customerUUID.toString(), |
242 | | - universeUUID.toString() |
243 | | - )); |
244 | | - } |
245 | | - return ApiResponse.success(Json.newObject().put( |
246 | | - "reference", keyRef |
247 | | - )); |
| 215 | + public Result getCurrentKeyRef(UUID customerUUID, UUID universeUUID) { |
| 216 | + LOG.info( |
| 217 | + String.format( |
| 218 | + "Retrieving key ref for customer %s and universe %s", |
| 219 | + customerUUID.toString(), universeUUID.toString())); |
| 220 | + KmsHistory activeKey = EncryptionAtRestUtil.getActiveKeyOrBadRequest(universeUUID); |
| 221 | + String keyRef = activeKey.uuid.keyRef; |
| 222 | + if (keyRef == null || keyRef.length() == 0) { |
| 223 | + throw new YWServiceException( |
| 224 | + BAD_REQUEST, |
| 225 | + String.format( |
| 226 | + "Could not retrieve key service for customer %s and universe %s", |
| 227 | + customerUUID.toString(), universeUUID.toString())); |
| 228 | + } |
| 229 | + return ApiResponse.success(Json.newObject().put("reference", keyRef)); |
248 | 230 | } |
249 | 231 | } |
0 commit comments