search

guardian / play-secret-rotation

Rotate your Application Secret on an active cluster of Play app servers
14 stars 3 forks source link

Using play-secret-rotation in a Java server #427

Open yotommy opened 9 months ago

yotommy commented 9 months ago

Apologies for raising an issue: if there is a better place to ask my question, please let me know.

In CiviForm, we use the Play framework in Java. I would love to use your package for rotating server secrets, but am having a bit of trouble understanding the required steps.

Note that I would like to use my own secretStateSupplier, rather than use the AWS parameter store.

The README for the parameter store option provides a clue how I might do this. In Updating ApplicationComponents with the rotating secret, it says:

In your ApplicationComponents, mix-in RotatingSecretComponents and provide the secretStateSupplier required by that trait.

This sounds very promising! However, our project does not currently have a custom ApplicationComponents subclass. Some experimenting with subclassing play.BuiltInComponentsFromContext has revealed complications since we want to maintain the current default handling of the router() and httpFilters() methods, but these are abstract in the superclass.

I also haven't had any success trying to find examples on the web.

Can you point to any guides for integrating your package in a Java project that doesn't (yet) have its own ApplicationComponents subclass?

yotommy commented 8 months ago

I posted a similar question to the Play discussion boards: Using play-secret-rotation in a Java server

I got the helpful answer that ApplicationComponents should not be required in our server because we use Guice for dependency injection.

However, I am still not sure what binding I need to set up in order to "activate" RotatingSecretComponents.

Also I tried creating a Java class that implements SnapshotProvider, but I get compilation errors suggesting that my approach may be flawed:

modules.CiviFormSecretSnapshotProvider is not abstract and does not override abstract method com$gu$play$secretrotation$SnapshotProvider$_setter_$logger_$eq(com.typesafe.scalalogging.Logger) in com.gu.play.secretrotation.SnapshotProvider

Is it feasible to use play-secret-rotation in a Java server that uses Guice?

rtyley commented 6 months ago

Hi @yotommy - I don't know if you ever got a solution for your problem, I hope things have progressed okay for you!

At the moment, play-secret-rotation is only written for the Scala part of the Play API, not the Java version - it looks like you've had a good go at getting it going, sorry that the logger field has been a stumbling block.

I recently raised https://github.com/playframework/playframework/issues/12520 to see if it would be possible to get some support for Application Secret rotation into Play itself - hopefully it can get some traction!

yotommy commented 6 months ago

Many thanks for the update, @rtyley! I have subscribed to that issue.