Package org.gcube.common.security.providers

Class SecretManagerProvider

java.lang.Object
org.gcube.common.security.providers.SecretManagerProvider
public class SecretManagerProvider extends Object
Provides a thread-safe way to manage and access a Secret object within the current execution thread.

This class uses an InheritableThreadLocal to ensure that a secret set in a parent thread is automatically inherited by any child threads that are created, which is crucial for managing authorization contexts in asynchronous or multi-threaded environments.

A thread inherits the secret set in the thread that creates it, at the time it is created, and keeps it for its whole life: a thread of a pool created while a request is served keeps the secret of that request for every task it runs later. Tasks given to an executor must therefore be wrapped with AuthorizedTasks.bind, which sets the intended secret when the task runs and resets it afterwards, or must call reset() themselves.

Author:
Luca Frosini (ISTI - CNR)

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    MDC_CONTEXT_KEY
    MDC key used to store the current gcube security context in the logging context.
    static final String
    MDC_USER_KEY
    MDC key used to store the identifier of the owner of the current secret (the user or the client that makes the request, or the container in its own tasks) in the logging context; absent when no secret is set in the current thread.

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecretManagerProvider()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static Secret
    get()
    Retrieves the Secret associated with the current thread.
    static void
    reset()
    Resets the Secret for the current thread, effectively removing it.
    static void
    set(Secret secret)
    Sets the Secret for the current thread.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • MDC_CONTEXT_KEY

      public static final String MDC_CONTEXT_KEY
      MDC key used to store the current gcube security context in the logging context.
      See Also:

    • MDC_USER_KEY

      public static final String MDC_USER_KEY
      MDC key used to store the identifier of the owner of the current secret (the user or the client that makes the request, or the container in its own tasks) in the logging context; absent when no secret is set in the current thread.
      See Also:

  • Constructor Details

    • SecretManagerProvider

      public SecretManagerProvider()

  • Method Details

    • get

      public static Secret get()
      Retrieves the Secret associated with the current thread.
      Returns:
      The Secret object for the current thread, or null if no secret has been set.

    • set

      public static void set(Secret secret)
      Sets the Secret for the current thread.

      This secret will be accessible by the current thread and any child threads it creates.

      When a secret is already set, the new one must have the same owner and the same Context, otherwise an IllegalStateException is thrown; it replaces the current one when its priority is the same or higher (e.g. a renewed token replaces the expired one), and is ignored when it is lower. A null secret is ignored.

      Parameters:
      secret - The Secret object to be set.
      Throws:
      IllegalStateException - when a secret of another owner or Context is already set in the current thread

    • reset

      public static void reset()
      Resets the Secret for the current thread, effectively removing it.

      This method should be called to clean up the thread-local secret, especially after a task is completed, to prevent security issues.