1
1
# Azure Key Vault Administration client library for Java
2
+
2
3
Azure Key Vault Managed HSM is a fully-managed, highly-available, single-tenant, standards-compliant cloud service that
3
4
enables you to safeguard cryptographic keys for your cloud applications using FIPS 140-2 Level 3 validated HSMs.
4
5
@@ -10,6 +11,7 @@ key-level role-based access control (RBAC).
10
11
## Getting started
11
12
12
13
### Prerequisites
14
+
13
15
- A [ Java Development Kit (JDK)] [ jdk_link ] , version 8 or later.
14
16
- Here are details about [ Java 8 client compatibility with Azure Certificate Authority] [ azure_ca ]
15
17
- An [ Azure Subscription] [ azure_subscription ] .
@@ -21,6 +23,7 @@ key-level role-based access control (RBAC).
21
23
### Adding the package to your product
22
24
23
25
#### Use the Azure SDK BOM
26
+
24
27
Please include the ` azure-sdk-bom ` to your project to take dependency on the General Availability (GA) version of the
25
28
library. In the following snippet, replace the {bom_version_to_target} placeholder with the version number. To learn
26
29
more about the BOM, see the [ AZURE SDK BOM README] [ azure_sdk_bom ] .
@@ -51,20 +54,24 @@ and then include the direct dependency in the dependencies section without the v
51
54
```
52
55
53
56
#### Use a direct dependency
57
+
54
58
If you want to take dependency on a particular version of the library that is not present in the BOM, add the direct
55
59
dependency to your project as follows.
56
60
57
61
[ // ] : # ( {x-version-update-start;com.azure.v2:azure-security-keyvault-administration;current} )
62
+
58
63
``` xml
59
64
<dependency >
60
65
<groupId >com.azure.v2</groupId >
61
66
<artifactId >azure-security-keyvault-administration</artifactId >
62
67
<version >5.0.0-beta.1</version >
63
68
</dependency >
64
69
```
70
+
65
71
[ // ] : # ( {x-version-update-end} )
66
72
67
73
### Authenticate the client
74
+
68
75
In order to interact with the Azure Key Vault service, you will need to create an instance of either the
69
76
[ ` KeyVaultAccessControlClient ` ] ( #create-an-access-control-client ) class, the
70
77
[ ` KeyVaultBackupClient ` ] ( #create-a-backup-client ) class, or the [ ` KeyVaultSettingsClient ` ] ( #create-a-settings-client )
@@ -77,6 +84,7 @@ You can find more information on different ways of authenticating and their corr
77
84
[ Azure Identity documentation] [ azure_identity ] .
78
85
79
86
#### Create an access control client
87
+
80
88
Once you perform [ the authentication set up that suits you best] [ default_azure_credential ] and replaced
81
89
** your-managed-hsm-endpoint** with the URL for your key vault or managed HSM, you can create the
82
90
` KeyVaultAccessControlClient ` :
@@ -89,6 +97,7 @@ KeyVaultAccessControlClient keyVaultAccessControlClient = new KeyVaultAccessCont
89
97
```
90
98
91
99
#### Create a backup client
100
+
92
101
Once you perform [ the authentication set up that suits you best] [ default_azure_credential ] and replaced
93
102
** your-managed-hsm-endpoint** with the URL for your key vault or managed HSM, you can create the ` KeyVaultBackupClient ` :
94
103
@@ -100,6 +109,7 @@ KeyVaultBackupClient keyVaultBackupClient = new KeyVaultBackupClientBuilder()
100
109
```
101
110
102
111
#### Create a settings client
112
+
103
113
Once you perform [ the authentication set up that suits you best] [ default_azure_credential ] and replaced
104
114
** your-managed-hsm-endpoint** with the URL for your key vault or managed HSM, you can create the
105
115
` KeyVaultSettingsClient ` :
@@ -112,22 +122,27 @@ KeyVaultBackupClient keyVaultBackupClient = new KeyVaultBackupClientBuilder()
112
122
```
113
123
114
124
## Key concepts
125
+
115
126
### Key Vault Access Control Client
127
+
116
128
The Key Vault Access Control Client performs the interactions with the Azure Key Vault or Managed HSM services for
117
129
getting, setting, deleting, and listing role assignments, as well as listing role definitions. Once you've initialized a
118
130
role assignment, you can interact with the primary resource types on the service.
119
131
120
132
### Role Definition
133
+
121
134
A role definition is a collection of permissions. It defines the operations that can be performed, such as read, write,
122
135
and delete. It can also define the operations that are excluded from allowed operations.
123
136
124
137
Role definitions can be listed and specified as part of a role assignment.
125
138
126
139
### Role Assignment
140
+
127
141
A role assignment is the association of a role definition to a service principal. They can be created, listed, fetched
128
142
individually, and deleted.
129
143
130
144
### Key Vault Backup Client
145
+
131
146
The Key Vault Backup Client provides operations for performing full key backups, full key restores, and selective key
132
147
restores.
133
148
@@ -137,27 +152,34 @@ restores.
137
152
> [ generate a SAS token in Storage Explorer] [ portal_sas_token ] .
138
153
139
154
### Pre-Backup Operation
155
+
140
156
A pre-backup operation represents a long-running operation that checks if it is possible to perform a full key backup.
141
157
142
158
### Backup Operation
159
+
143
160
A backup operation represents a long-running operation for a full key backup.
144
161
145
162
### Pre-Restore Operation
163
+
146
164
A pre-restore operation represents a long-running operation that checks if it is possible to perform a full key restore
147
165
from a backup.
148
166
149
167
### Restore Operation
168
+
150
169
A restore operation represents a long-running operation for both a full key and selective key restore.
151
170
152
171
### Key Vault Settings Client
172
+
153
173
The Key Vault Settings client allows manipulation of an Azure Key Vault or Managed HSM account's settings, with
154
174
operations such as: getting, updating, and listing.
155
175
156
176
## Access control operations
157
177
158
178
### Examples
179
+
159
180
The following sections provide several code snippets covering some of the most common role-based access control tasks,
160
181
including:
182
+
161
183
- [ List role definitions] ( #list-role-definitions )
162
184
- [ Create or update a role definition] ( #create-or-update-a-role-definition )
163
185
- [ Retrieve a role definition] ( #retrieve-a-role-definition )
@@ -167,6 +189,7 @@ including:
167
189
- [ Delete a role assignment] ( #delete-a-role-assignment )
168
190
169
191
##### List role definitions
192
+
170
193
List the role definitions in the key vault or managed HSM by calling ` listRoleDefinitions() ` .
171
194
172
195
``` java readme-sample-listRoleDefinitions
@@ -178,6 +201,7 @@ roleDefinitions.forEach(roleDefinition ->
178
201
```
179
202
180
203
##### Create or update a role definition
204
+
181
205
Create or update a role definition. The following example shows how to create a role definition with a randomly
182
206
generated name.
183
207
@@ -189,6 +213,7 @@ System.out.printf("Created role definition with randomly generated name '%s' and
189
213
```
190
214
191
215
##### Retrieve a role definition
216
+
192
217
Get an existing role definition. To do this, the scope and 'name' property from an existing role definition are
193
218
required.
194
219
@@ -202,6 +227,7 @@ System.out.printf("Retrieved role definition with name '%s' and role name '%s'.%
202
227
```
203
228
204
229
##### Delete a role definition
230
+
205
231
Delete a role definition. To do this, the scope and 'name' property from an existing role definition are required.
206
232
207
233
``` java readme-sample-deleteRoleDefinition
@@ -213,6 +239,7 @@ System.out.printf("Deleted role definition with name '%s'.%n", roleDefinitionNam
213
239
```
214
240
215
241
##### List role assignments
242
+
216
243
List the role assignments in the key vault or managed HSM by calling ` listRoleAssignments() ` .
217
244
218
245
``` java readme-sample-listRoleAssignments
@@ -224,6 +251,7 @@ roleAssignments.forEach(roleAssignment ->
224
251
```
225
252
226
253
##### Create a role assignment
254
+
227
255
Create a role assignment. To do this, a role definition id and a service principal object id are required.
228
256
229
257
A role definition id can be obtained from the 'id' property of one of the role definitions returned from
@@ -249,6 +277,7 @@ System.out.printf("Created role assignment with randomly generated name '%s' for
249
277
```
250
278
251
279
##### Retrieve a role assignment
280
+
252
281
Get an existing role assignment. To do this, the 'name' property from an existing role assignment is required.
253
282
254
283
``` java readme-sample-getRoleAssignment
@@ -258,7 +287,9 @@ KeyVaultRoleAssignment roleAssignment =
258
287
259
288
System . out. printf(" Retrieved role assignment with name '%s'.%n" , roleAssignment. getName());
260
289
```
290
+
261
291
##### Delete a role assignment
292
+
262
293
To remove a role assignment from a service principal, the role assignment must be deleted. To do this, the 'name'
263
294
property from an existing role assignment is required.
264
295
@@ -273,12 +304,15 @@ System.out.printf("Deleted role assignment with name '%s'.%n", roleAssignmentNam
273
304
## Backup and restore operations
274
305
275
306
### Examples
307
+
276
308
The following sections provide several code snippets covering some of the most common backup-related tasks, including:
309
+
277
310
- [ Backup a Key Vault] ( #backup-a-collection-of-keys )
278
311
- [ Restore a Key Vault] ( #restore-a-collection-of-keys )
279
312
- [ Restore a key] ( #selectively-restore-a-key )
280
313
281
314
##### Backup a collection of keys
315
+
282
316
Back up an entire collection of keys using ` beginBackup() ` .
283
317
284
318
``` java readme-sample-beginBackup
@@ -306,6 +340,7 @@ if (finalPollResponse.getStatus() == LongRunningOperationStatus.SUCCESSFULLY_COM
306
340
```
307
341
308
342
##### Restore a collection of keys
343
+
309
344
Restore an entire collection of keys from a backup using ` beginRestore() ` .
310
345
311
346
``` java readme-sample-beginRestore
@@ -331,6 +366,7 @@ if (finalPollResponse.getStatus() == LongRunningOperationStatus.SUCCESSFULLY_COM
331
366
```
332
367
333
368
##### Selectively restore a key
369
+
334
370
Restore a specific key from a backup using ` beginSelectiveRestore() ` .
335
371
336
372
``` java readme-sample-beginSelectiveKeyRestore
@@ -359,12 +395,15 @@ if (finalPollResponse.getStatus() == LongRunningOperationStatus.SUCCESSFULLY_COM
359
395
## Settings operations
360
396
361
397
### Examples
398
+
362
399
The following sections provide several code snippets covering some of the most common settings-related tasks, including:
400
+
363
401
- [ Listing settings] ( #get-all-settings )
364
402
- [ Retrieving a setting] ( #retrieve-a-specific-setting )
365
403
- [ Updating a setting] ( #update-a-specific-setting )
366
404
367
405
##### Get all settings
406
+
368
407
List all the settings for an Azure Key Vault or Managed HSM account.
369
408
370
409
``` java readme-sample-getSettings
@@ -376,6 +415,7 @@ for (KeyVaultSetting setting : getSettingsResult.getSettings()) {
376
415
```
377
416
378
417
##### Retrieve a specific setting
418
+
379
419
Retrieve a specific setting.
380
420
381
421
``` java readme-sample-getSetting
@@ -387,6 +427,7 @@ System.out.printf("Retrieved setting '%s' with value '%s'.%n", setting.getName()
387
427
```
388
428
389
429
##### Update a specific setting
430
+
390
431
Update a specific setting.
391
432
392
433
``` java readme-sample-updateSetting
@@ -398,16 +439,18 @@ System.out.printf("Updated setting '%s' to '%s'.%n", updatedSetting.getName(), u
398
439
```
399
440
400
441
## Troubleshooting
442
+
401
443
See our [ troubleshooting guide] [ troubleshooting_guide ] for details on how to diagnose various failure scenarios.
402
444
403
445
### General
446
+
404
447
Azure Key Vault clients raise exceptions. For example, if you try to retrieve a key after it is deleted a ` 404 ` error
405
448
is returned, indicating the resource was not found. In the following snippet, the error is handled gracefully by
406
449
catching the exception and displaying additional information about the error.
407
450
408
451
``` java readme-sample-troubleshooting
409
452
try {
410
- keyVaultAccessControlClient. getRoleAssignment(KeyVaultRoleScope . GLOBAL , " <role-assginment -name>" );
453
+ keyVaultAccessControlClient. getRoleAssignment(KeyVaultRoleScope . GLOBAL , " <role-assignment -name>" );
411
454
} catch (HttpResponseException e) {
412
455
System . out. println(e. getMessage());
413
456
}
@@ -427,23 +470,27 @@ better performance compared to the default SSL implementation within the JDK. Fo
427
470
reduce the dependency size, refer to the [ performance tuning] [ performance_tuning ] section of the wiki.
428
471
429
472
## Next steps
473
+
430
474
Several Azure Key Vault Java client library samples are available to you in the SDK's GitHub repository. These samples
431
475
provide example code for additional scenarios commonly encountered while working with Azure Key Vault.
432
476
433
477
## Next steps samples
478
+
434
479
Samples are explained in detail [ here] [ samples_readme ] .
435
480
436
481
### Additional documentation
437
- For more extensive documentation on Azure Key Vault, see the [ API reference documentation] [ azkeyvault_rest ] .
482
+
483
+ For more extensive documentation on Azure Key Vault, see the [ API reference documentation] [ azure_keyvault_rest ] .
438
484
439
485
## Contributing
486
+
440
487
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License
441
488
Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For
442
- details, visit https://cla.microsoft.com .
489
+ details, see the [ Microsoft CLA ] [ microsoft_cla ] .
443
490
444
491
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate
445
492
the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to
446
- do this once across all repos using our CLA.
493
+ do this once across all repos using our [ CLA] [ microsoft_cla ] .
447
494
448
495
This project has adopted the [ Microsoft Open Source Code of Conduct] [ microsoft_code_of_conduct ] . For more information
449
496
see the Code of Conduct FAQ or contact
< [email protected] > with any additional questions or comments.
@@ -460,13 +507,12 @@ For details on contributing to this repository, see the [contributing guide][con
460
507
[ api_documentation ] : https://azure.github.io/azure-sdk-for-java
461
508
[ administration_samples ] : https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/keyvault-v2/azure-security-keyvault-administration/src/samples/java/com/azure/v2/security/keyvault/administration
462
509
[ azkeyvault_docs ] : https://learn.microsoft.com/azure/key-vault/
463
- [ azkeyvault_rest ] : https://learn.microsoft.com/rest/api/keyvault/
510
+ [ azure_keyvault_rest ] : https://learn.microsoft.com/rest/api/keyvault/
464
511
[ azure_ca ] : https://learn.microsoft.com/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list#client-compatibility-for-public-pkis
465
512
[ azure_cli ] : https://learn.microsoft.com/cli/azure
466
513
[ azure_identity ] : https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/identity/azure-identity
467
514
[ azure_keyvault ] : https://learn.microsoft.com/azure/key-vault/general/overview
468
515
[ azure_keyvault_cli ] : https://learn.microsoft.com/azure/key-vault/general/quick-create-cli
469
- [ azure_keyvault_mhsm ] : https://learn.microsoft.com/azure/key-vault/managed-hsm/overview
470
516
[ azure_keyvault_mhsm_cli ] : https://learn.microsoft.com/azure/key-vault/managed-hsm/quick-create-cli
471
517
[ azure_keyvault_portal ] : https://learn.microsoft.com/azure/key-vault/general/quick-create-portal
472
518
[ azure_subscription ] : https://azure.microsoft.com/free/
@@ -476,6 +522,7 @@ For details on contributing to this repository, see the [contributing guide][con
476
522
[ http_clients_wiki ] : https://learn.microsoft.com/azure/developer/java/sdk/http-client-pipeline#http-clients
477
523
[ jdk_link ] : https://learn.microsoft.com/java/azure/jdk/?view=azure-java-stable
478
524
[ managed_identity ] : https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview
525
+ [ microsoft_cla ] : https://cla.microsoft.com
479
526
[ microsoft_code_of_conduct ] : https://opensource.microsoft.com/codeofconduct/
480
527
[ samples_readme ] : https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/keyvault-v2/azure-security-keyvault-administration/src/samples/README.md
481
528
[ performance_tuning ] : https://github.com/Azure/azure-sdk-for-java/wiki/Performance-Tuning
0 commit comments