Spring Boot

Integrate the Conjur Spring Boot Plugin with existing and new Spring Boot applications to retrieve secrets from Conjur.

The Spring Boot Plugin provides client-side support for externalized configuration of secrets in a distributed system. Using the Spring Boot Plugin, applications can retrieve application credentials and secrets stored in Conjur with minimal code changes to the existing Spring Boot application code.

Benefits of storing application secrets in the CyberArk Vault

The following features are available with the Spring Boot Plugin:

• Provides one central location for storing and retrieving secrets for applications across all environments

• Supports the management of static and dynamic secrets such as username and password for remote applications and resources

• Provides credentials for external services like MySQL, PostgreSQL, Apache Cassandra, Couchbase, MongoDB, Consul, AWS, and more

Certification level

This repository is a Certified-level project. It's a Community contributed project, reviewed and tested by CyberArk and trusted to use with Conjur. For more information about our certification levels, see our community guidelines.

Features

The following features are available with the Spring Boot Plugin:

• Retrieve a single secret by specifying the path to the secret in the CyberArk Vault

• Retrieve multiple secrets by specifying the paths to the secrets in the CyberArk Vault

• Retrieve secrets from the CyberArk Vault and initialize the Spring Boot environment with remote property sources

Limitations

The Spring Boot Plugin does not support creating, deleting, or updating secrets.

Technical requirements

• Java 11
  

• Conjur Open Source Suite (OSS) version 1.9 or later

• Conjur Enterprise 12.5

• Conjur SDK (Java) 4.0.0

• Conjur API 5.1

Set up the Spring Boot Plugin with Conjur

Step 1: Prerequisite: Set up Conjur

Make sure that Conjur and the Conjur CLI are installed and that they are running in the background.

• Conjur setup

• CLI setup

Step 2: Set up Spring Boot Plugin

This section describes how to set up the Spring Boot Plugin. You can use a dependency configuration that is imported from Maven Central, or you can import the Spring Boot Plugin manually by building the source code locally.

Step 3: Set up trust between the app and Conjur

By default, Conjur generates and uses self-signed SSL certificates. Without trusting them, the Java app cannot connect to Conjur using the Conjur APIs. You need to configure your app to trust them.

1. Copy the .pem certificate created while setting up Conjur.

2. Set up trusted Conjur self-signed certificates:

   • Eclipse IDE
   • IntelliJ

   1. In Eclipse, right -click Client Class and select Properties > Run... > New.

   2. Select the Configuration popup and click the Java app.

   3. In the Edit Launch Configuration properties window, select the Environment tab and click Add.

   4. In the New Environment Variable window, enter CONJUR_SSL_CERTIFICATE in the Name field and the copied certificate in the Value field.

   Follow the steps outlined in the IntelliJ documentation.

Step 4: Set up environment variables

Define the variables needed to make the connection between the Spring Boot Plugin and Conjur. You can do this by setting environment variables.

In Conjur, environment variables are mapped to configuration variables by prepending CONJUR_ to the all-caps name of the configuration variable. For example: appliance_url is CONJUR_APPLIANCE_URL, account is CONJUR_ACCOUNT.

If no other configuration is done (e.g. over system properties or CLI parameters), include the following environment variables in the app's runtime environment to use the Spring Boot Plugin.

Only one CONJUR_CERT_FILE and CONJUR_SSL_CERTIFICATE is required. There are two variables to allow the user to specify the path to a certificate file or provide the certificate data directly in an environment variable.

Use the Spring Boot Plugin

You can use the Spring Boot Plugin using the standard Spring @Value annotation, or using Conjur native annotations.

Spring Standard @Value annotation

The @ConjurPropertySource annotation allows you to specify the root of a policy to look up. The Spring Boot Plugin routes the lookup to Conjur through the Conjur Spring Boot SDK and an exposed REST API. Using @ConjurPropertySource in conjunction with @Configuration classes is required. The names of secrets, passwords, and user IDs all remain as originally specified. You can fetch Conjur managed secrets using a standard @Value annotation.

By adding an optional file with the name conjur.properties in a Spring Boot classloader discoverable location (<a path>/resources/), you can map the names of secrets as specified in the application code to the names stored in the CyberArk Vault.

Example use case: Given the following Vault path policy/my-application containing the database.password=mysecretpassword configuration data pair, the following @Configuration class uses @ConjurPropertySource to contribute policy/my-application to the environment's set of PropertySources:

@Configuration
@ConjurPropertySource("policy/my-application/")
@ConjurPropertySource("policy/my-other-application/")
@ConjurPropertySource(value={"policy/my-application/", "policy/my-other-application/"}, name="")
public class AppConfig {

@Autowired
Environment env;

@Value("${database.password}")
private byte[] password;

@Bean
public TestBean testBean() {
    TestBean testBean = new TestBean();
    testBean.setPassword(password);
    return testBean;
      }
 }
Conjur Properties (conjur.properties)

conjur.mapping.database.password=MyConjurOraclePassword

Conjur native annotations (custom annotation)

The @ConjurValue and @ConjurValues annotations are intended for new Spring Boot applications. Injecting @ConjurValue into your Spring Boot code allows you to retrieve a single secret from the CyberArk Vault. @ConjurValues allows you to retrieve multiple secrets from the Vault.

@Configuration
public class AppConfig {

@ConjurValue("policy/my-application/database.password")
private byte[] password;

@ConjurValues({"policy/my-application/db.userName","policy/my-application/db.password","policy/my-application/db.name"})
private byte[] secrets;

@Bean
public TestBean testBean() {
    TestBean testBean = new TestBean();
    testBean.setPassword(password);
    return testBean;
      }
 }

Contributing

We welcome contributions. Visit the Contributing Guide repo on GitHub.