GUACAMOLE-2137 : OpenBao/Hashicorp Vault extension

doc/licenses/apache-sshd/NOTICE

@@ -0,0 +1,16 @@
+# Name:    Apache Mina SSHD
+# URL:     https://mina.apache.org/sshd-project
+# From:    'Apache Software Foundation' (https://www.apache.org/)
+# License: Apache v2.0
+# Source:  https://raw.githubusercontent.com/apache/mina-sshd/refs/tags/sshd-${VERSION}/NOTICE.txt
+#
+# --- BEGIN LICENSE FILE [2.17.1] ---
+Apache MINA SSHD
+Copyright 2008-2021 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+Please refer to each LICENSE.<component>.txt file for the
+license terms of the components that Apache MINA depends on.
+# --- END LICENSE FILE [2.17.1] ---

doc/licenses/apache-sshd/dep-coordinates.txt

@@ -0,0 +1,3 @@
+org.apache.sshd:sshd-common:jar:*
+org.apache.sshd:sshd-core:jar:*
+

doc/licenses/net-i2p-crypto/LICENSE

@@ -0,0 +1,6 @@
+# Name: EdDSA Java Implementation
+# Version: 0.3.0
+# From: str4d (original author)
+# Project: https://github.com/str4d/ed25519-java
+# Maven Coordinates: net.i2p.crypto:eddsa
+# License: CC0 1.0 Universal (Public Domain Dedication)

doc/licenses/net-i2p-crypto/dep-coordinates.txt

@@ -0,0 +1 @@
+net.i2p.crypto:eddsa:jar:*

doc/licenses/spring-framework/dep-coordinates.txt

@@ -4,3 +4,5 @@ org.springframework:spring-beans:jar:*
 org.springframework:spring-context:jar:*
 org.springframework:spring-core:jar:*
 org.springframework:spring-expression:jar:*
+org.springframework:spring-jcl:jar:*
+org.springframework:spring-web:jar:*

doc/licenses/spring-vault/LICENSE

@@ -0,0 +1,4 @@
+# Name:    Spring Vault
+# URL:     https://spring.io/projects/spring-vault
+# From:    'Spring' (https://spring.io/)
+# License: Apache v2.0

doc/licenses/spring-vault/dep-coordinates.txt

@@ -0,0 +1 @@
+org.springframework.vault:spring-vault-core:jar:*

extensions/guacamole-vault/modules/guacamole-vault-dist/pom.xml

@@ -49,6 +49,13 @@
             <version>${revision}</version>
         </dependency>
 
+        <!-- Hashicorp Vault Extension -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-vault-hv</artifactId>
+            <version>${revision}</version>
+        </dependency>
+
    </dependencies>
 
     <build>

extensions/guacamole-vault/modules/guacamole-vault-dist/src/main/assembly/dist.xml

@@ -41,6 +41,14 @@
             </includes>
         </dependencySet>
 
+        <!-- Hashicorp Vault extension .jar -->
+        <dependencySet>
+            <outputDirectory>hv</outputDirectory>
+            <includes>
+                <include>org.apache.guacamole:guacamole-vault-hv</include>
+            </includes>
+        </dependencySet>
+
     </dependencySets>
 
     <!-- Licenses -->

extensions/guacamole-vault/modules/guacamole-vault-hv/pom.xml

@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+                        http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.guacamole</groupId>
+    <artifactId>guacamole-vault-hv</artifactId>
+    <packaging>jar</packaging>
+    <name>guacamole-vault-hv</name>
+    <url>http://guacamole.apache.org/</url>
+
+    <parent>
+        <groupId>org.apache.guacamole</groupId>
+        <artifactId>guacamole-vault</artifactId>
+        <version>${revision}</version>
+        <relativePath>../../</relativePath>
+    </parent>
+
+    <properties>
+        <kotlin.version>1.9.25</kotlin.version>
+    </properties>
+
+    <dependencies>
+
+        <!-- Guacamole Extension API -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-ext</artifactId>
+        </dependency>
+
+        <!-- Guacamole base key vault support -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-vault-base</artifactId>
+            <version>${revision}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>${jackson-databind.version}</version>
+        </dependency>
+
+        <!-- Use same version of Kotlin across all dependencies -->
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-reflect</artifactId>
+            <version>${kotlin.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib</artifactId>
+            <version>${kotlin.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib-jdk8</artifactId>
+            <version>${kotlin.version}</version>
+        </dependency>
+
+        <!-- Use Spring to access the Vault -->
+        <dependency>
+          <groupId>org.springframework.vault</groupId>
+          <artifactId>spring-vault-core</artifactId>
+          <version>2.3.4</version>
+        </dependency>
+
+        <!-- For SSH key generation -->
+        <dependency>
+          <groupId>org.apache.sshd</groupId>
+          <artifactId>sshd-common</artifactId>
+          <version>2.17.1</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>org.slf4j</groupId>
+                  <artifactId>jcl-over-slf4j</artifactId>
+              </exclusion>
+          </exclusions>
+        </dependency>
+
+        <!-- For SSH key generation - ed25519 support-->
+        <dependency>
+          <groupId>net.i2p.crypto</groupId>
+          <artifactId>eddsa</artifactId>
+          <version>0.3.0</version>
+        </dependency>
+
+        <!-- For Caching support -->
+        <dependency>
+          <groupId>com.github.ben-manes.caffeine</groupId>
+          <artifactId>caffeine</artifactId>
+          <version>2.9.3</version>
+          <exclusions>
+            <exclusion>
+              <groupId>org.checkerframework</groupId>
+              <artifactId>checker-qual</artifactId>
+            </exclusion>
+            <exclusion>
+              <groupId>com.google.errorprone</groupId>
+              <artifactId>error_prone_annotations</artifactId>
+            </exclusion>
+          </exclusions>
+        </dependency>
+    </dependencies>
+
+</project>

extensions/guacamole-vault/modules/guacamole-vault-hv/src/main/java/org/apache/guacamole/vault/hv/HvAuthenticationProvider.java

@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.hv;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.vault.VaultAuthenticationProvider;
+
+/**
+ * VaultAuthenticationProvider implementation which reads secrets from
+ * Hashicorp Vault
+ */
+public class HvAuthenticationProvider extends VaultAuthenticationProvider {
+
+    /**
+     * Creates a new HvKeyVaultAuthenticationProvider which reads secrets
+     * from a configured OpenBao/Hashicorp Vault.
+     *
+     * @throws GuacamoleException
+     *     If configuration details cannot be read from guacamole.properties.
+     */
+    public HvAuthenticationProvider() throws GuacamoleException {
+        super(new HvAuthenticationProviderModule());
+    }
+
+    @Override
+    public String getIdentifier() {
+        return "hashicorp-vault";
+    }
+}

extensions/guacamole-vault/modules/guacamole-vault-hv/src/main/java/org/apache/guacamole/vault/hv/HvAuthenticationProviderModule.java

@@ -0,0 +1,86 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.hv;
+
+import com.google.inject.assistedinject.FactoryModuleBuilder;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.vault.VaultAuthenticationProviderModule;
+import org.apache.guacamole.vault.conf.VaultAttributeService;
+import org.apache.guacamole.vault.conf.VaultConfigurationService;
+import org.apache.guacamole.vault.hv.conf.HvAttributeService;
+import org.apache.guacamole.vault.hv.conf.HvConfigurationService;
+import org.apache.guacamole.vault.hv.secret.HvClient;
+import org.apache.guacamole.vault.hv.secret.HvClientProvider;
+import org.apache.guacamole.vault.hv.secret.HvSecretService;
+import org.apache.guacamole.vault.hv.secret.HvTunnelEventListener;
+import org.apache.guacamole.vault.hv.user.HvDirectoryService;
+import org.apache.guacamole.vault.hv.user.HvUser;
+import org.apache.guacamole.vault.secret.VaultSecretService;
+import org.apache.guacamole.vault.user.VaultDirectoryService;
+
+/**
+ * Guice module which configures injections specific to OpenBao/Hashicorp Vault
+ * support.
+ */
+public class HvAuthenticationProviderModule
+        extends VaultAuthenticationProviderModule {
+
+    /**
+     * Creates a new HvAuthenticationProviderModule which
+     * configures dependency injection for the Hashicorp Vault
+     * authentication provider and related services.
+     *
+     * @throws GuacamoleException
+     *     If configuration details in guacamole.properties cannot be parsed.
+     */
+    public HvAuthenticationProviderModule() throws GuacamoleException {
+        // This constructor is intentionally empty
+        super();
+    }
+
+    /**
+     * Configures injections for interfaces which are implementation-specific
+     * to the vault service in use.
+     */
+    @Override
+    protected void configureVault() {
+
+        // Bind services specific to Hashicorp Vault
+        bind(HvAttributeService.class);
+        bind(VaultAttributeService.class).to(HvAttributeService.class);
+        bind(VaultConfigurationService.class).to(HvConfigurationService.class);
+        bind(VaultSecretService.class).to(HvSecretService.class).asEagerSingleton();
+        bind(VaultDirectoryService.class).to(HvDirectoryService.class);
+
+        // Bind factory for creating HV Clients
+        install(new FactoryModuleBuilder()
+                .implement(HvClient.class, HvClient.class)
+                .build(HvClientProvider.HvClientFactory.class));
+
+        // Bind factory for creating HvUsers
+        install(new FactoryModuleBuilder()
+                .implement(HvUser.class, HvUser.class)
+                .build(HvUser.HvUserFactory.class));
+
+        // Static Injection of the Listener to get TunnelConnectEvent and TunnelCloseEvent
+        requestStaticInjection(HvTunnelEventListener.class);
+    }
+
+}