Skip to content

Commit ab08598

Browse files
reinkrulreinkrul
committed
change credential to auth
1 parent 3c39ef6 commit ab08598

File tree

7 files changed

+16
-13
lines changed

7 files changed

+16
-13
lines changed

‎README.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ The following options can be configured on the server:
184184
crypto.azurekv.hsm false Whether to store the key in a hardware security module (HSM). If true, the Azure Key Vault must be configured for HSM usage. Default: false
185185
crypto.azurekv.timeout 10s Timeout of client calls to Azure Key Vault, in Golang time.Duration string format (e.g. 10s).
186186
crypto.azurekv.url The URL of the Azure Key Vault.
187+
crypto.azurekv.auth.type default Credential type to use when authenticating to the Azure Key Vault. Options: default, managed_identity (see https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/README.md for an explanation of the options).
187188
crypto.vault.address The Vault address. If set it overwrites the VAULT_ADDR env var.
188189
crypto.vault.pathprefix kv The Vault path prefix.
189190
crypto.vault.timeout 5s Timeout of client calls to Vault, in Golang time.Duration string format (e.g. 1s).
@@ -201,7 +202,7 @@ The following options can be configured on the server:
201202
http.internal.auth.type Whether to enable authentication for /internal endpoints, specify 'token_v2' for bearer token mode or 'token' for legacy bearer token mode.
202203
http.public.address \:8080 Address and port the server will be listening to for public-facing endpoints.
203204
**JSONLD**
204-
jsonld.contexts.localmapping [https://w3id.org/vc/status-list/2021/v1=assets/contexts/w3c-statuslist2021.ldjson,https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json=assets/contexts/lds-jws2020-v1.ldjson,https://schema.org=assets/contexts/schema-org-v13.ldjson,https://nuts.nl/credentials/v1=assets/contexts/nuts.ldjson,https://www.w3.org/2018/credentials/v1=assets/contexts/w3c-credentials-v1.ldjson] This setting allows mapping external URLs to local files for e.g. preventing external dependencies. These mappings have precedence over those in remoteallowlist.
205+
jsonld.contexts.localmapping [https://nuts.nl/credentials/v1=assets/contexts/nuts.ldjson,https://www.w3.org/2018/credentials/v1=assets/contexts/w3c-credentials-v1.ldjson,https://w3id.org/vc/status-list/2021/v1=assets/contexts/w3c-statuslist2021.ldjson,https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json=assets/contexts/lds-jws2020-v1.ldjson,https://schema.org=assets/contexts/schema-org-v13.ldjson] This setting allows mapping external URLs to local files for e.g. preventing external dependencies. These mappings have precedence over those in remoteallowlist.
205206
jsonld.contexts.remoteallowlist [https://schema.org,https://www.w3.org/2018/credentials/v1,https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json,https://w3id.org/vc/status-list/2021/v1] In strict mode, fetching external JSON-LD contexts is not allowed except for context-URLs listed here.
206207
**PKI**
207208
pki.maxupdatefailhours 4 Maximum number of hours that a denylist update can fail

‎crypto/cmd/cmd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func FlagSet() *pflag.FlagSet {
4747
flags.String("crypto.azurekv.url", defs.AzureKeyVault.URL, "The URL of the Azure Key Vault.")
4848
flags.Duration("crypto.azurekv.timeout", defs.AzureKeyVault.Timeout, "Timeout of client calls to Azure Key Vault, in Golang time.Duration string format (e.g. 10s).")
4949
flags.Bool("crypto.azurekv.hsm", defs.AzureKeyVault.UseHSM, fmt.Sprintf("Whether to store the key in a hardware security module (HSM). If true, the Azure Key Vault must be configured for HSM usage. Default: %t", defs.AzureKeyVault.UseHSM))
50-
flags.String("crypto.azurekv.credential.type", defs.AzureKeyVault.Credential.Type, fmt.Sprintf("Credential type to use when authenticating to the Azure Key Vault. Options: %s, %s (see https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/README.md for an explanation of the options).", azure.DefaultChainCredentialType, azure.ManagedIdentityCredentialType))
50+
flags.String("crypto.azurekv.auth.type", defs.AzureKeyVault.Auth.Type, fmt.Sprintf("Credential type to use when authenticating to the Azure Key Vault. Options: %s, %s (see https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/README.md for an explanation of the options).", azure.DefaultChainCredentialType, azure.ManagedIdentityCredentialType))
5151
flags.String("crypto.external.address", defs.External.Address, "Address of the external storage service.")
5252
flags.Duration("crypto.external.timeout", defs.External.Timeout, "Time-out when invoking the external storage backend, in Golang time.Duration string format (e.g. 1s).")
5353

‎crypto/storage/azure/interface.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,12 @@ type Config struct {
3434
// UseHSM specifies whether to store the key in a hardware security module (HSM).
3535
// If true, the Azure Key Vault must be configured for HSM usage.
3636
UseHSM bool `koanf:"hsm"`
37-
// Credential specifies the credential to use for authentication to the Azure Key Vault.
38-
Credential CredentialConfig `koanf:"credential"`
37+
// Auth specifies the credential to use for authentication to the Azure Key Vault.
38+
Auth AuthConfig `koanf:"auth"`
3939
}
4040

41-
// CredentialConfig contains the config options to configure the credential to use for authentication to the Azure Key Vault.
42-
type CredentialConfig struct {
41+
// AuthConfig contains the config options to configure the credential to use for authentication to the Azure Key Vault.
42+
type AuthConfig struct {
4343
// Type specifies the type of credential to use for authentication to the Azure Key Vault.
4444
Type string `koanf:"type"`
4545
}
@@ -49,7 +49,7 @@ func DefaultConfig() Config {
4949
return Config{
5050
Timeout: 10 * time.Second,
5151
UseHSM: false,
52-
Credential: CredentialConfig{
52+
Auth: AuthConfig{
5353
Type: DefaultChainCredentialType,
5454
},
5555
}

‎crypto/storage/azure/keyvault.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func New(config Config) (spi.Storage, error) {
5151
if config.URL == "" {
5252
return nil, errors.New("missing Azure Key Vault URL")
5353
}
54-
credential, err := createCredential(config.Credential.Type)
54+
credential, err := createCredential(config.Auth.Type)
5555
if err != nil {
5656
return nil, err
5757
}

‎crypto/storage/azure/keyvault_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -298,9 +298,9 @@ func TestIntegrationTest(t *testing.T) {
298298
os.Setenv("AZURE_CLIENT_SECRET", "")
299299

300300
store, err := New(Config{
301-
URL: "https://geheim-keyvault.vault.azure.net/",
302-
Timeout: 10 * time.Second,
303-
Credential: CredentialConfig{Type: DefaultChainCredentialType},
301+
URL: "https://geheim-keyvault.vault.azure.net/",
302+
Timeout: 10 * time.Second,
303+
Auth: AuthConfig{Type: DefaultChainCredentialType},
304304
})
305305
assert.NoError(t, err)
306306

‎docs/pages/deployment/cli-reference.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ The following options apply to the server commands below:
2020
--auth.irma.schememanager string IRMA schemeManager to use for attributes. Can be either 'pbdf' or 'irma-demo'. (default "pbdf")
2121
--configfile string Nuts config file (default "./config/nuts.yaml")
2222
--cpuprofile string When set, a CPU profile is written to the given path. Ignored when strictmode is set.
23+
--crypto.azurekv.auth.type string Credential type to use when authenticating to the Azure Key Vault. Options: default, managed_identity (see https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/README.md for an explanation of the options). (default "default")
2324
--crypto.azurekv.hsm Whether to store the key in a hardware security module (HSM). If true, the Azure Key Vault must be configured for HSM usage. Default: false
2425
--crypto.azurekv.timeout duration Timeout of client calls to Azure Key Vault, in Golang time.Duration string format (e.g. 10s). (default 10s)
2526
--crypto.azurekv.url string The URL of the Azure Key Vault.
@@ -47,7 +48,7 @@ The following options apply to the server commands below:
4748
--http.public.address string Address and port the server will be listening to for public-facing endpoints. (default ":8080")
4849
--httpclient.timeout duration Request time-out for HTTP clients, such as '10s'. Refer to Golang's 'time.Duration' syntax for a more elaborate description of the syntax. (default 30s)
4950
--internalratelimiter When set, expensive internal calls are rate-limited to protect the network. Always enabled in strict mode. (default true)
50-
--jsonld.contexts.localmapping stringToString This setting allows mapping external URLs to local files for e.g. preventing external dependencies. These mappings have precedence over those in remoteallowlist. (default [https://www.w3.org/2018/credentials/v1=assets/contexts/w3c-credentials-v1.ldjson,https://w3id.org/vc/status-list/2021/v1=assets/contexts/w3c-statuslist2021.ldjson,https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json=assets/contexts/lds-jws2020-v1.ldjson,https://schema.org=assets/contexts/schema-org-v13.ldjson,https://nuts.nl/credentials/v1=assets/contexts/nuts.ldjson])
51+
--jsonld.contexts.localmapping stringToString This setting allows mapping external URLs to local files for e.g. preventing external dependencies. These mappings have precedence over those in remoteallowlist. (default [https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json=assets/contexts/lds-jws2020-v1.ldjson,https://schema.org=assets/contexts/schema-org-v13.ldjson,https://nuts.nl/credentials/v1=assets/contexts/nuts.ldjson,https://www.w3.org/2018/credentials/v1=assets/contexts/w3c-credentials-v1.ldjson,https://w3id.org/vc/status-list/2021/v1=assets/contexts/w3c-statuslist2021.ldjson])
5152
--jsonld.contexts.remoteallowlist strings In strict mode, fetching external JSON-LD contexts is not allowed except for context-URLs listed here. (default [https://schema.org,https://www.w3.org/2018/credentials/v1,https://w3c-ccg.github.io/lds-jws2020/contexts/lds-jws2020-v1.json,https://w3id.org/vc/status-list/2021/v1])
5253
--loggerformat string Log format (text, json) (default "text")
5354
--network.bootstrapnodes strings List of bootstrap nodes ('<host>:<port>') which the node initially connect to.

0 commit comments

Comments
 (0)