feat: [Connectivity] Dynamic Keystore in HttpDestination#1202
Conversation
…ion-keystore # Conflicts: # cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2Options.java
| * The {@link KeyStore} to be used when communicating over HTTP. | ||
| */ | ||
| @Nonnull | ||
| public Builder keyStore( @Nullable final KeyStore keyStore ) |
There was a problem hiding this comment.
no new public API, just replaces the previous public @Setter
| @Nullable | ||
| private final KeyStore keyStore; | ||
| @Nonnull | ||
| private final Supplier<Option<KeyStore>> keyStore; |
There was a problem hiding this comment.
Supplier<Option<KeyStore>> looks a bit strange, but this is because allowing a supplier to return null is often dangerous (especially, because our current annotations don't allow declaring Supplier<@Nullable KeyStore>). This solution was the least un-intuitive variant I could find that allows for the KeyStore to be null but still using a supplier.
Jonas-Isr
left a comment
Jonas-Isr
left a comment
There was a problem hiding this comment.
Only minor issues/questions :)
| .append(resolveKeyStoreHashCode(keyStore)) | ||
| .append(resolveKeyStoreHashCode(keyStoreSupplier.get().getOrNull())) |
There was a problem hiding this comment.
(Question)
How often do we expect the certificate to rotate (and thus the keyStore to differ)? Could this become a problem with hashCode() returning a different value then, resulting in cache misses or similar?
There was a problem hiding this comment.
For now, this should only apply for ZTIS, since the new API is internal and only used there. Certs are expected to change rotate between 12hrs or 3.5 days, so not often.
Indeed, a rotated certificate would cause a cache miss if it were cached, but currently we don't have this for the ZTIS use case. But even if we did, I think that would be okay, this would have been the old behavior / expectation anyway 🙂
…/cloud/sdk/cloudplatform/connectivity/DefaultHttpDestination.java Co-authored-by: Jonas-Isr <jonas.israel@sap.com>
3 participants
Context
Follow-up for #1142
Allows in-place rotation for destination keystore to fully support #1134
Feature scope:
DefaultHttpDestinationto supportSupplier<Keystore>OAuth2ServiceBindingDestinationLoaderand related classes to use this capabilityDefinition of Done
Documentation updated