|
| 1 | +package frameworks |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "os" |
| 6 | + "path/filepath" |
| 7 | +) |
| 8 | + |
| 9 | +// ClientCertificateMapperFramework implements mTLS client certificate mapper support |
| 10 | +// This framework provides automatic mapping of Cloud Foundry client certificates |
| 11 | +// for mutual TLS (mTLS) authentication in Java applications |
| 12 | +type ClientCertificateMapperFramework struct { |
| 13 | + context *Context |
| 14 | +} |
| 15 | + |
| 16 | +// NewClientCertificateMapperFramework creates a new client certificate mapper framework instance |
| 17 | +func NewClientCertificateMapperFramework(ctx *Context) *ClientCertificateMapperFramework { |
| 18 | + return &ClientCertificateMapperFramework{context: ctx} |
| 19 | +} |
| 20 | + |
| 21 | +// Detect checks if client certificate mapper should be included |
| 22 | +// Enabled by default to support mTLS scenarios, can be disabled via configuration |
| 23 | +func (c *ClientCertificateMapperFramework) Detect() (string, error) { |
| 24 | + // Check if explicitly disabled via configuration |
| 25 | + if !c.isEnabled() { |
| 26 | + return "", nil |
| 27 | + } |
| 28 | + |
| 29 | + // Enabled by default to support mTLS client certificate authentication |
| 30 | + return "Client Certificate Mapper", nil |
| 31 | +} |
| 32 | + |
| 33 | +// Supply installs the client certificate mapper JAR |
| 34 | +func (c *ClientCertificateMapperFramework) Supply() error { |
| 35 | + c.context.Log.BeginStep("Installing Client Certificate Mapper") |
| 36 | + |
| 37 | + // Get client-certificate-mapper dependency from manifest |
| 38 | + dep, err := c.context.Manifest.DefaultVersion("client-certificate-mapper") |
| 39 | + if err != nil { |
| 40 | + return fmt.Errorf("unable to determine Client Certificate Mapper version: %w", err) |
| 41 | + } |
| 42 | + |
| 43 | + // Install client certificate mapper JAR |
| 44 | + mapperDir := filepath.Join(c.context.Stager.DepDir(), "client_certificate_mapper") |
| 45 | + if err := c.context.Installer.InstallDependency(dep, mapperDir); err != nil { |
| 46 | + return fmt.Errorf("failed to install Client Certificate Mapper: %w", err) |
| 47 | + } |
| 48 | + |
| 49 | + c.context.Log.Info("Installed Client Certificate Mapper version %s", dep.Version) |
| 50 | + return nil |
| 51 | +} |
| 52 | + |
| 53 | +// Finalize adds the client certificate mapper JAR to the application classpath |
| 54 | +func (c *ClientCertificateMapperFramework) Finalize() error { |
| 55 | + // Find the installed JAR |
| 56 | + mapperDir := filepath.Join(c.context.Stager.DepDir(), "client_certificate_mapper") |
| 57 | + jarPattern := filepath.Join(mapperDir, "client-certificate-mapper-*.jar") |
| 58 | + |
| 59 | + matches, err := filepath.Glob(jarPattern) |
| 60 | + if err != nil || len(matches) == 0 { |
| 61 | + // JAR not found, might not have been installed |
| 62 | + return nil |
| 63 | + } |
| 64 | + |
| 65 | + // Add to classpath via CLASSPATH environment variable |
| 66 | + classpath := os.Getenv("CLASSPATH") |
| 67 | + if classpath != "" { |
| 68 | + classpath += ":" |
| 69 | + } |
| 70 | + classpath += matches[0] |
| 71 | + |
| 72 | + if err := c.context.Stager.WriteEnvFile("CLASSPATH", classpath); err != nil { |
| 73 | + return fmt.Errorf("failed to set CLASSPATH for Client Certificate Mapper: %w", err) |
| 74 | + } |
| 75 | + |
| 76 | + return nil |
| 77 | +} |
| 78 | + |
| 79 | +// isEnabled checks if client certificate mapper is enabled |
| 80 | +// Default is true (enabled) to support mTLS scenarios unless explicitly disabled |
| 81 | +func (c *ClientCertificateMapperFramework) isEnabled() bool { |
| 82 | + // Check JBP_CONFIG_CLIENT_CERTIFICATE_MAPPER environment variable |
| 83 | + config := os.Getenv("JBP_CONFIG_CLIENT_CERTIFICATE_MAPPER") |
| 84 | + |
| 85 | + // Parse the config to check for enabled: false |
| 86 | + // For simplicity, if JBP_CONFIG_CLIENT_CERTIFICATE_MAPPER is set and contains "enabled", check its value |
| 87 | + // A more robust implementation would parse YAML |
| 88 | + if config != "" { |
| 89 | + // Simple check: if it contains "enabled: false" or "'enabled': false" |
| 90 | + if contains(config, "enabled: false") || contains(config, "'enabled': false") { |
| 91 | + return false |
| 92 | + } |
| 93 | + if contains(config, "enabled: true") || contains(config, "'enabled': true") { |
| 94 | + return true |
| 95 | + } |
| 96 | + } |
| 97 | + |
| 98 | + // Default to enabled (to support mTLS client certificate authentication) |
| 99 | + return true |
| 100 | +} |
0 commit comments