Move ssh keys into dedicated files

src/inttest/resources/config/application.yml

@@ -21,39 +21,10 @@ spring:
   mail:
     host: false
 
-
 faf-api:
   jwt:
-    secretKey: |-
-      -----BEGIN RSA PRIVATE KEY-----
-      MIIEpgIBAAKCAQEAzTpJ/ytBu3dih41bEqRnchNfkyCigIWDHrbBa+0Szw853Oew
-      LJ1Zwe5wh9L8nxWD7f+pVDg5dAKXAJabmx6vuXhJjekIxrHTIRdxebO2norhAK/Q
-      OuOZ4NKinShpWwyLgmPcJZaKq1TNtVm7No/3CQK5XugDJ5NG2c1RNEAdk3pk2EkB
-      lhhObJW2vUY+KmJ+4ndwZKeyJD4CTr4sJK7cWRf2Ht2RWq6omFlsnQiPGyO9/VYo
-      YQz3fVTiXdf4+xg6toBaVvult0YPS5/jm611RrsMwLM4ZpWkUlytxR/N8/oLb9rD
-      nO9+OQZDpIsKfNd3ZAqg/wZTHIcb474UHjUTiQIDAQABAoIBAQCMuO1IZNbbvs72
-      97x9GfI8zH/6mKQU0HfKNbKHWLZO+LfKe6vXy8ViLydGWywRwWUHawkm0K7El4oH
-      Qz5LrUz9NjfpcOMtq32D8VlEBDCyobQLDoMP/kTjXktWzAECB6YZsHOh6ooHVU0A
-      jxjKHwlbSlzlcN3I4znv2tNVqqkdF9Gbg7wUmN9n0qpj+7kDtkixJy3jm9YLxKCS
-      pNZ1UUjGKtVgl/1871slNUtANHj/xCnkYrOncrIXf472pEeSxBU5JlI4fILcyTtG
-      B9btuYBk7Z239TWDEZTqIyst0QGteNRsjE+gkB9WV1ra9JPPWDiBYye4qqaIs3al
-      jd3lkMApAoGBAP+i1aJ/c8XV18eTMYLmQZRnkjrkxyQMhJ/x+6tow6p6A16lDwHh
-      tRoyQk0XdTpQegu+YtdBXSRk6zNzE2njWEVOMK4/Zqt5a1yMSE/8MMQVler1ChdF
-      PWhZCPb+CfKm1RHXpFMsmBZx+7MumLQwjCtZfQl8YMt34gfVcXRSZ50DAoGBAM2F
-      FVrTTUVaGv6zjdO7K+5eUj0VRR2nGId5nIWqouQryJaizeBZfWatjDYVbl0qHFy2
-      QnHA+3UEsVWOkJG90rZcP4UWcDy86e5T/3FR2Xfy3kW10Gfe6hrjjbjYflleD5Qg
-      uZ9ovk/TZjTjvMWisNBSW1FILz9SMLWHoCFPGOmDAoGBANKRb4X1lAiOt7n13d+k
-      CLrUgVgvoHVqNkiFi7dKiXnAHUx1i6ISKBoW8hQMUYyiQ5Wu0j3a4n0a/74WeRRM
-      pyYXXPP613hBgJTwHJR9+DFcUmwCQbifWRC93iuNX+ZXU8Tpqrq0TeaXJywWIsSy
-      BJOkl+EbaaPP8Qhg4Z5eTmi/AoGBAMzSDyA/acjuLe0cwQH8jaG3+rnJkuIkf3u0
-      pVtJXaGMSRJnGkq2pRVJbG0SGrVanH2BXuLDc1eB38HmnQnCZlc7xEo8vIqrs2/D
-      4tXqvpKeRwquUg7Sx/kYQ0uu5uzloxz7KENIPjKL+lZHiQBmTVSwXzW4fO3cWZLw
-      oZPQooFFAoGBAMVvhsOmlpwyyS9s/CVIMirvLQEuEIIS5fMcnmCmu8P49ZZ7YSVf
-      2OJOSGj+lWkEMf2qOW7kYl303GrESeJ36KmLbDthnH+p6RSq5NzN5CAucffA0tsa
-      keX0a6YHVu9doUPhUFJdbgg8FIL1FVEJROQckMAiDcYg2mFXmtaVTjqX
-      -----END RSA PRIVATE KEY-----
-    publicKey: |-
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNOkn/K0G7d2KHjVsSpGdyE1+TIKKAhYMetsFr7RLPDznc57AsnVnB7nCH0vyfFYPt/6lUODl0ApcAlpubHq+5eEmN6QjGsdMhF3F5s7aeiuEAr9A645ng0qKdKGlbDIuCY9wlloqrVM21Wbs2j/cJArle6AMnk0bZzVE0QB2TemTYSQGWGE5slba9Rj4qYn7id3Bkp7IkPgJOviwkrtxZF/Ye3ZFarqiYWWydCI8bI739VihhDPd9VOJd1/j7GDq2gFpW+6W3Rg9Ln+ObrXVGuwzAszhmlaRSXK3FH83z+gtv2sOc7345BkOkiwp813dkCqD/BlMchxvjvhQeNROJ [email protected]
+    secret-key-path: test-pki-private.key
+    public-key-path: test-pki-public.key
   map:
     target-directory: "build/cache/map/maps"
     directory-preview-path-small: "build/cache/map_previews/small"

src/main/java/com/faforever/api/config/FafApiProperties.java

@@ -50,8 +50,8 @@ public static class Jwt {
     /**
      * The secret used for JWT token generation.
      */
-    private String secretKey;
-    private String publicKey;
+    private Path secretKeyPath;
+    private Path publicKeyPath;
     private int accessTokenValiditySeconds = 3600;
     private int refreshTokenValiditySeconds = 3600;
   }

src/main/java/com/faforever/api/config/security/oauth2/OAuthJwtConfig.java

@@ -11,6 +11,9 @@
 import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
 
+import java.io.IOException;
+import java.nio.file.Files;
+
 @Configuration
 public class OAuthJwtConfig {
 
@@ -35,10 +38,13 @@ public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter) {
   }
 
   @Bean
-  protected JwtAccessTokenConverter jwtAccessTokenConverter() {
+  protected JwtAccessTokenConverter jwtAccessTokenConverter() throws IOException {
+    String secretKey = Files.readString(fafApiProperties.getJwt().getSecretKeyPath());
+    String publicKey = Files.readString(fafApiProperties.getJwt().getPublicKeyPath());
+
     JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
-    jwtAccessTokenConverter.setSigningKey(fafApiProperties.getJwt().getSecretKey());
-    jwtAccessTokenConverter.setVerifierKey(fafApiProperties.getJwt().getPublicKey());
+    jwtAccessTokenConverter.setSigningKey(secretKey);
+    jwtAccessTokenConverter.setVerifierKey(publicKey);
     ((DefaultAccessTokenConverter) jwtAccessTokenConverter.getAccessTokenConverter()).setUserTokenConverter(new FafUserAuthenticationConverter());
     return jwtAccessTokenConverter;
   }

src/main/java/com/faforever/api/security/FafTokenService.java

@@ -16,6 +16,8 @@
 import org.springframework.util.Assert;
 
 import javax.validation.constraints.NotNull;
+import java.io.IOException;
+import java.nio.file.Files;
 import java.text.MessageFormat;
 import java.time.Instant;
 import java.time.temporal.TemporalAmount;
@@ -32,10 +34,13 @@ public class FafTokenService {
   private final RsaSigner rsaSigner;
   private final RsaVerifier rsaVerifier;
 
-  public FafTokenService(ObjectMapper objectMapper, FafApiProperties properties) {
+  public FafTokenService(ObjectMapper objectMapper, FafApiProperties properties) throws IOException {
+    String secretKey = Files.readString(properties.getJwt().getSecretKeyPath());
+    String publicKey = Files.readString(properties.getJwt().getPublicKeyPath());
+
     this.objectMapper = objectMapper;
-    this.rsaSigner = new RsaSigner(properties.getJwt().getSecretKey());
-    this.rsaVerifier = new RsaVerifier(properties.getJwt().getPublicKey());
+    this.rsaSigner = new RsaSigner(secretKey);
+    this.rsaVerifier = new RsaVerifier(publicKey);
   }
 
   /**

src/main/java/com/faforever/api/security/JwtService.java

@@ -10,6 +10,7 @@
 
 import javax.inject.Inject;
 import java.io.IOException;
+import java.nio.file.Files;
 
 @Service
 public class JwtService {
@@ -18,9 +19,12 @@ public class JwtService {
   private final ObjectMapper objectMapper;
 
   @Inject
-  public JwtService(FafApiProperties fafApiProperties, ObjectMapper objectMapper) {
-    this.rsaSigner = new RsaSigner(fafApiProperties.getJwt().getSecretKey());
-    this.rsaVerifier = new RsaVerifier(fafApiProperties.getJwt().getPublicKey());
+  public JwtService(FafApiProperties fafApiProperties, ObjectMapper objectMapper) throws IOException {
+    String secretKey = Files.readString(fafApiProperties.getJwt().getSecretKeyPath());
+    String publicKey = Files.readString(fafApiProperties.getJwt().getPublicKeyPath());
+
+    this.rsaSigner = new RsaSigner(secretKey);
+    this.rsaVerifier = new RsaVerifier(publicKey);
     this.objectMapper = objectMapper;
   }
 

src/main/resources/config/application-dev.yml

@@ -1,7 +1,8 @@
 faf-api:
   version: dev
   jwt:
-    secret: ${JWT_SECRET:banana}
+    secretKeyPath: ${JWT_PRIVATE_KEY_PATH:test-pki-private.key}
+    publicKeyPath: ${JWT_PUBLIC_KEY_PATH:test-pki-public.key}
   map:
     target-directory: ${MAP_UPLOAD_PATH:build/cache/map/maps}
     directory-preview-path-small: ${MAP_PREVIEW_PATH_SMALL:build/cache/map_previews/small}

src/main/resources/config/application-prod.yml

@@ -1,6 +1,7 @@
 faf-api:
   jwt:
-    secret: ${JWT_SECRET}
+    secretKeyPath: ${JWT_PRIVATE_KEY_PATH}
+    publicKeyPath: ${JWT_PUBLIC_KEY_PATH}
   map:
     target-directory: ${MAP_UPLOAD_PATH}
     directory-preview-path-small: ${MAP_PREVIEW_PATH_SMALL}

src/test/java/com/faforever/api/security/FafTokenServiceTest.java

@@ -18,6 +18,8 @@
 import org.springframework.security.jwt.crypto.sign.RsaSigner;
 import org.springframework.security.jwt.crypto.sign.RsaVerifier;
 
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import java.time.Duration;
 import java.util.Collections;
 import java.util.Map;
@@ -65,19 +67,22 @@ public class FafTokenServiceTest {
   private ObjectMapper objectMapper;
   private FafTokenService instance;
 
-  public FafTokenServiceTest() {
-    this.rsaSigner = new RsaSigner(TEST_SECRET_KEY);
-    this.rsaVerifier = new RsaVerifier(TEST_PUBLIC_KEY);
+  public FafTokenServiceTest() throws Exception {
+    String privateKey = Files.readString(Paths.get("test-pki-private.key"));
+    String publicKey = Files.readString(Paths.get("test-pki-public.key"));
+
+    this.rsaSigner = new RsaSigner(privateKey);
+    this.rsaVerifier = new RsaVerifier(publicKey);
   }
 
   @BeforeEach
-  public void setUp() {
+  public void setUp() throws Exception {
     objectMapper = new ObjectMapper();
     objectMapper.registerModule(new JavaTimeModule());
 
     FafApiProperties properties = new FafApiProperties();
-    properties.getJwt().setSecretKey(TEST_SECRET_KEY);
-    properties.getJwt().setPublicKey(TEST_PUBLIC_KEY);
+    properties.getJwt().setSecretKeyPath(Paths.get("test-pki-private.key"));
+    properties.getJwt().setPublicKeyPath(Paths.get("test-pki-public.key"));
 
     instance = new FafTokenService(objectMapper, properties);
   }

src/test/java/com/faforever/api/user/UserServiceTest.java

@@ -109,7 +109,6 @@ private static User createUser(int id, String name, String password, String emai
   @BeforeEach
   public void setUp() {
     properties = new FafApiProperties();
-    properties.getJwt().setSecretKey(TEST_SECRET);
     properties.getLinkToSteam().setSteamRedirectUrlFormat("%s");
     instance = new UserService(emailService, playerRepository, userRepository, nameRecordRepository, properties, anopeUserRepository, fafTokenService, steamService, Optional.of(mauticService), globalRatingRepository, ladder1v1RatingRepository);
   }

test-pki-private.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpgIBAAKCAQEAzTpJ/ytBu3dih41bEqRnchNfkyCigIWDHrbBa+0Szw853Oew
+LJ1Zwe5wh9L8nxWD7f+pVDg5dAKXAJabmx6vuXhJjekIxrHTIRdxebO2norhAK/Q
+OuOZ4NKinShpWwyLgmPcJZaKq1TNtVm7No/3CQK5XugDJ5NG2c1RNEAdk3pk2EkB
+lhhObJW2vUY+KmJ+4ndwZKeyJD4CTr4sJK7cWRf2Ht2RWq6omFlsnQiPGyO9/VYo
+YQz3fVTiXdf4+xg6toBaVvult0YPS5/jm611RrsMwLM4ZpWkUlytxR/N8/oLb9rD
+nO9+OQZDpIsKfNd3ZAqg/wZTHIcb474UHjUTiQIDAQABAoIBAQCMuO1IZNbbvs72
+97x9GfI8zH/6mKQU0HfKNbKHWLZO+LfKe6vXy8ViLydGWywRwWUHawkm0K7El4oH
+Qz5LrUz9NjfpcOMtq32D8VlEBDCyobQLDoMP/kTjXktWzAECB6YZsHOh6ooHVU0A
+jxjKHwlbSlzlcN3I4znv2tNVqqkdF9Gbg7wUmN9n0qpj+7kDtkixJy3jm9YLxKCS
+pNZ1UUjGKtVgl/1871slNUtANHj/xCnkYrOncrIXf472pEeSxBU5JlI4fILcyTtG
+B9btuYBk7Z239TWDEZTqIyst0QGteNRsjE+gkB9WV1ra9JPPWDiBYye4qqaIs3al
+jd3lkMApAoGBAP+i1aJ/c8XV18eTMYLmQZRnkjrkxyQMhJ/x+6tow6p6A16lDwHh
+tRoyQk0XdTpQegu+YtdBXSRk6zNzE2njWEVOMK4/Zqt5a1yMSE/8MMQVler1ChdF
+PWhZCPb+CfKm1RHXpFMsmBZx+7MumLQwjCtZfQl8YMt34gfVcXRSZ50DAoGBAM2F
+FVrTTUVaGv6zjdO7K+5eUj0VRR2nGId5nIWqouQryJaizeBZfWatjDYVbl0qHFy2
+QnHA+3UEsVWOkJG90rZcP4UWcDy86e5T/3FR2Xfy3kW10Gfe6hrjjbjYflleD5Qg
+uZ9ovk/TZjTjvMWisNBSW1FILz9SMLWHoCFPGOmDAoGBANKRb4X1lAiOt7n13d+k
+CLrUgVgvoHVqNkiFi7dKiXnAHUx1i6ISKBoW8hQMUYyiQ5Wu0j3a4n0a/74WeRRM
+pyYXXPP613hBgJTwHJR9+DFcUmwCQbifWRC93iuNX+ZXU8Tpqrq0TeaXJywWIsSy
+BJOkl+EbaaPP8Qhg4Z5eTmi/AoGBAMzSDyA/acjuLe0cwQH8jaG3+rnJkuIkf3u0
+pVtJXaGMSRJnGkq2pRVJbG0SGrVanH2BXuLDc1eB38HmnQnCZlc7xEo8vIqrs2/D
+4tXqvpKeRwquUg7Sx/kYQ0uu5uzloxz7KENIPjKL+lZHiQBmTVSwXzW4fO3cWZLw
+oZPQooFFAoGBAMVvhsOmlpwyyS9s/CVIMirvLQEuEIIS5fMcnmCmu8P49ZZ7YSVf
+2OJOSGj+lWkEMf2qOW7kYl303GrESeJ36KmLbDthnH+p6RSq5NzN5CAucffA0tsa
+keX0a6YHVu9doUPhUFJdbgg8FIL1FVEJROQckMAiDcYg2mFXmtaVTjqX
+-----END RSA PRIVATE KEY-----

test-pki-public.key

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNOkn/K0G7d2KHjVsSpGdyE1+TIKKAhYMetsFr7RLPDznc57AsnVnB7nCH0vyfFYPt/6lUODl0ApcAlpubHq+5eEmN6QjGsdMhF3F5s7aeiuEAr9A645ng0qKdKGlbDIuCY9wlloqrVM21Wbs2j/cJArle6AMnk0bZzVE0QB2TemTYSQGWGE5slba9Rj4qYn7id3Bkp7IkPgJOviwkrtxZF/Ye3ZFarqiYWWydCI8bI739VihhDPd9VOJd1/j7GDq2gFpW+6W3Rg9Ln+ObrXVGuwzAszhmlaRSXK3FH83z+gtv2sOc7345BkOkiwp813dkCqD/BlMchxvjvhQeNROJ [email protected]