blobfish-azure-keyvault-ruby 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 0c1049b41eee7072d1d270b3c7a0216743e0880f
+  data.tar.gz: ff779e037f2ab6606c55d51fff48236c6590bd4b
+SHA512:
+  metadata.gz: ae7efa284f86c8b641069562a7d425f774bc9462dca0732facacc298d028f67a1c4f4023a30a1fcdf15bb99227322d6ea6d5e80701a22f08c067c4a65c10da6d
+  data.tar.gz: 4d5a98a558192983b9dc57557f17bfc92edcd4d6441a017d3f9b801ef426e2684f16987b4f76476dfca3c45f7ce98161b385f370844eebca00975cbfd6238693

data/.gitignore

@@ -0,0 +1,11 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+/.idea/
+/*.gem

data/Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in blobfish-azure-keyvault-ruby.gemspec
+gemspec

data/README.md

@@ -0,0 +1,28 @@
+# Blobfish::Keyvault
+
+This gem allows to sign with a key stored in Azure Key Vault as well as getting a certificate from Azure Key Vault. It manages authentication to Azure Key Vault in a very simple way for the client.
+
+## TODOs
+
+- Evaluate to remove the concept of a certificate and private key classes. 
+- Evaluate to fork https://github.com/stuartbarr/azure-key-vault making a major refactor to get a similar API to the one in the official https://github.com/Azure/azure-keyvault-java, or just start from scratch?. Anyway maintain the name of this gem in the 'blobfish' namespace, i.e. 'blobfish-azure-keyvault-ruby' with the 'blobfish-' prefix to avoid eventually clashing with an eventual official gem that could be published by Microsoft.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'blobfish-azure-keyvault-ruby'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install blobfish-azure-keyvault-ruby
+
+## Usage
+
+For a demonstration project (in spanish) see https://github.com/hablutzel1/blobfish-azure-keyvault-ruby-demo.

data/blobfish-azure-keyvault-ruby.gemspec

@@ -0,0 +1,23 @@
+# coding: utf-8
+lib = File.expand_path("../lib", __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "blobfish/keyvault/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "blobfish-azure-keyvault-ruby"
+  spec.version       = Blobfish::Keyvault::VERSION
+  spec.authors       = ["Jaime Hablutzel"]
+  spec.email         = ["hablutzel1@gmail.com"]
+
+  spec.summary       = "Blobfish's Ruby client for Azure Key Vault."
+  spec.description   = "Ruby client currently allowing to simplify performing certain operations in Azure Key Vault (getting a certificate and signing)."
+  spec.homepage      = "https://github.com/hablutzel1/blobfish-azure-keyvault-ruby"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.require_paths = ["lib"]
+  spec.add_runtime_dependency 'rest-client'
+  spec.add_runtime_dependency 'json'
+  spec.add_development_dependency "bundler", "~> 1.15"
+end

data/lib/blobfish/keyvault.rb

@@ -0,0 +1,10 @@
+require "blobfish/keyvault/version"
+require 'blobfish/keyvault/authenticated_requestor'
+require 'blobfish/keyvault/certificate'
+require 'blobfish/keyvault/private_key'
+
+module Blobfish
+  module Keyvault
+    # Your code goes here...
+  end
+end

data/lib/blobfish/keyvault/api_version.rb

@@ -0,0 +1,7 @@
+module Blobfish
+  module Keyvault
+    class ApiVersion
+      DEFAULT_API_VERSION = '2016-10-01'
+    end
+  end
+end

data/lib/blobfish/keyvault/authenticated_requestor.rb

@@ -0,0 +1,36 @@
+require 'rest-client'
+require 'json'
+
+module Blobfish
+  module Keyvault
+    class AuthenticatedRequestor
+      @authorization_header = nil
+      def initialize(client_id, client_secret)
+        @client_id = client_id
+        @client_secret = client_secret
+      end
+      def execute(method, url, payload = nil, headers = {})
+        begin
+          perform_request(method, url, payload, headers)
+        rescue RestClient::Unauthorized => e
+          renew_access_token(e.response.headers[:www_authenticate])
+          perform_request(method, url, payload, headers)
+        end
+      end
+      private
+      def perform_request(method, url, payload, headers)
+        RestClient::Request.execute(:method => method, :url => url, :payload => payload, :headers => {Authorization: @authorization_header}.merge!(headers))
+      end
+      # TODO check for possible concurrency problems around the calls to 'renew_access_token', for example, if two different threads end up in the first 'perform_request' call (the one before the 'rescue') with an expired token at the same time, both will end up in a call to 'renew_access_token' generating unnecessarily more than one 'access_token'.
+      def renew_access_token(www_authenticate_header)
+        # TODO look for an standard way to parse this WWW-Authenticate header content.
+        auth_url = www_authenticate_header.match(/authorization="(.*?)"/i).captures.first
+        auth_url << '/oauth2/token'
+        # TODO extract the 'https://vault.azure.net' 'resource' from the WWW-Authenticate header. Could it really differ from 'https://vault.azure.net'?.
+        response = RestClient::Request.execute(method: :post, url: auth_url, payload: {grant_type: 'client_credentials', client_id: @client_id, client_secret: @client_secret, resource: 'https://vault.azure.net'}, headers: {'Content-Type': 'application/x-www-form-urlencoded'})
+        access_token = JSON.parse(response)['access_token']
+        @authorization_header = "Bearer #{access_token}"
+      end
+    end
+  end
+end

data/lib/blobfish/keyvault/certificate.rb

@@ -0,0 +1,24 @@
+require 'blobfish/keyvault/authenticated_requestor'
+require 'blobfish/keyvault/api_version'
+require 'json'
+require 'base64'
+
+module Blobfish
+  module Keyvault
+    class Certificate
+      def initialize(certificate_id, requestor)
+        url = certificate_id + '?api-version=' + ApiVersion::DEFAULT_API_VERSION
+        response = requestor.execute(:get, url)
+        @cert_b64 = JSON.parse(response)['cer']
+      end
+      def to_base64()
+        @cert_b64
+      end
+      def public_key
+        cert_as_der = Base64.decode64(@cert_b64)
+        certificate = OpenSSL::X509::Certificate.new cert_as_der
+        certificate.public_key
+      end
+    end
+  end
+end

data/lib/blobfish/keyvault/private_key.rb

@@ -0,0 +1,27 @@
+require 'blobfish/keyvault/authenticated_requestor'
+require 'blobfish/keyvault/api_version'
+require 'json'
+require 'base64'
+
+module Blobfish
+  module Keyvault
+    class PrivateKey
+      # @param [AuthenticatedRequestor] requestor
+      def initialize(key_id, requestor)
+        @key_id = key_id
+        @requestor = requestor
+      end
+      def sign(digest, data)
+        raise NotImplementedError, 'Only SHA-256 digest signature algorithm is currently supported.' unless digest.instance_of? OpenSSL::Digest::SHA256
+        sha256 = Digest::SHA256.new
+        base64_digest = Base64.strict_encode64(sha256.digest(data))
+        url = @key_id + '/sign?api-version=' + ApiVersion::DEFAULT_API_VERSION
+        response = @requestor.execute(:post, url, {alg: 'RS256', value: base64_digest}.to_json, {'Content-Type': "application/json"})
+        base64_signature = JSON.parse(response)['value']
+        base64_signature.tr!('-_', '+/')
+        # TODO check: the previous 'base64_signature' could be missing padding '=' (equals) chars. Confirm that it is never required to complete the padding chars before decoding.
+        Base64.decode64(base64_signature)
+      end
+    end
+  end
+end

data/lib/blobfish/keyvault/version.rb

@@ -0,0 +1,5 @@
+module Blobfish
+  module Keyvault
+    VERSION = "0.1.1"
+  end
+end

metadata

@@ -0,0 +1,96 @@
+--- !ruby/object:Gem::Specification
+name: blobfish-azure-keyvault-ruby
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- Jaime Hablutzel
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-06-08 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rest-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.15'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.15'
+description: Ruby client currently allowing to simplify performing certain operations
+  in Azure Key Vault (getting a certificate and signing).
+email:
+- hablutzel1@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- README.md
+- blobfish-azure-keyvault-ruby.gemspec
+- lib/blobfish/keyvault.rb
+- lib/blobfish/keyvault/api_version.rb
+- lib/blobfish/keyvault/authenticated_requestor.rb
+- lib/blobfish/keyvault/certificate.rb
+- lib/blobfish/keyvault/private_key.rb
+- lib/blobfish/keyvault/version.rb
+homepage: https://github.com/hablutzel1/blobfish-azure-keyvault-ruby
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5.2
+signing_key: 
+specification_version: 4
+summary: Blobfish's Ruby client for Azure Key Vault.
+test_files: []