Package com.ibm.cloud.sdk.core.security

Class VpcInstanceAuthenticator

  • All Implemented Interfaces:
    Authenticator
    public class VpcInstanceAuthenticator
extends TokenRequestBasedAuthenticator<IamToken,​VpcTokenResponse>
implements Authenticator
    VpcInstanceAuthenticator implements an authentication scheme in which it retrieves an "instance identity token" and exchanges that for an IAM access token using the VPC Instance Metadata Service API which is available on a local VPC-managed compute resource (VM).

    The instance identity token is similar to an IAM apikey, except that it is managed automatically by the compute resource provider (VPC).

    The resulting IAM access token is then added to outbound requests in an Authorization header of the form: "Authorization: Bearer <access-token>"

    • Method Detail

      • newBuilder

        public VpcInstanceAuthenticator.Builder newBuilder()
        Returns a new Builder instance pre-loaded with the configuration from "this".
        Returns:
        the Builder instance

      • fromConfiguration

        public static VpcInstanceAuthenticator fromConfiguration​(java.util.Map<java.lang.String,​java.lang.String> config)
        Constructs a ContainerAuthenticator instance using properties contained in the specified Map.
        Parameters:
        config - a map containing the configuration properties
        Returns:
        the ContainerAuthenticator instance

      • getIamProfileCrn

        public java.lang.String getIamProfileCrn()
        Returns:
        the iamProfileCrn configured on this Authenticator.

      • getIamProfileId

        public java.lang.String getIamProfileId()
        Returns:
        the iamProfileId configured on this Authenticator.

      • getURL

        public java.lang.String getURL()
        Returns:
        the URL configured on this Authenticator.

      • retrieveInstanceIdentityToken

        public java.lang.String retrieveInstanceIdentityToken()
                                               throws java.lang.Throwable
        Retrieves the local compute resource's instance identity token using the "create_access_token" operation of the local VPC Instance Metadata Service API.
        Returns:
        the instance identity token
        Throws:
        java.lang.Throwable - if an error occurred

      • retrieveIamAccessToken

        public IamToken retrieveIamAccessToken​(java.lang.String instanceIdentityToken)
        Retrieves the IAM access token by invoking the VPC "create_iam_token" operation.
        Parameters:
        instanceIdentityToken - the current compute resource's instance identity token
        Returns:
        the IamToken instance containing the IAM access token