KeyVault JCA: lazy-load certificate material and add alias regex filtering

sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md

@@ -3,6 +3,8 @@
 ## 2.13.0-beta.1 (Unreleased)
 
 ### Features Added
+- Added lazy loading for Key Vault certificate details in the JCA keystore. Certificate details are now loaded by alias when requested, avoiding unnecessary reads for unconfigured certificates. ([#49774](https://github.com/Azure/azure-sdk-for-java/pull/49774))
+- Added support for `azure.keyvault.jca.certificate-alias-filter-pattern` to filter Key Vault certificate aliases with include/exclude regex patterns. Include patterns are configured directly and exclude patterns are prefixed with `!`. Configure more than one filter by appending a suffix to the property name, such as `azure.keyvault.jca.certificate-alias-filter-pattern.1`, so that a pattern can contain any character. If no such property is configured, alias filtering is disabled and all discovered Key Vault aliases remain eligible for lazy loading. ([#39487](https://github.com/Azure/azure-sdk-for-java/issues/39487))
 
 ### Breaking Changes
 

sdk/keyvault/azure-security-keyvault-jca/README.md

@@ -141,6 +141,7 @@ The JCA library supports configuring the following options:
 * `azure.keyvault.jca.refresh-certificates-when-have-un-trust-certificate`: Indicates whether to refresh certificates when have untrusted certificate.
 * `azure.keyvault.jca.certificates-refresh-interval`: The refresh interval time.
 * `azure.keyvault.jca.certificates-refresh-interval-in-ms`: The refresh interval time.
+* `azure.keyvault.jca.certificate-alias-filter-pattern`: A regex that filters which Key Vault certificate aliases are eligible for lazy loading. Append a suffix to the property name to configure more than one filter, for example `azure.keyvault.jca.certificate-alias-filter-pattern.1` or `azure.keyvault.jca.certificate-alias-filter-pattern.prod`. If no such property is configured, all discovered Key Vault aliases are eligible for lazy loading. See "Filtering Key Vault certificate aliases" below.
 * `azure.keyvault.disable-challenge-resource-verification`: Indicates whether to disable verification that the authentication challenge resource matches the Key Vault or Managed HSM domain.
 
 You can configure these properties using:
@@ -152,6 +153,30 @@ or as a JVM argument:
 -Dazure.keyvault.uri=<your-azure-keyvault-uri>
 ```
 
+#### Filtering Key Vault certificate aliases
+
+Each filter is configured as its own property, so no delimiter is required and a pattern may contain any character:
+
+```shell
+-Dazure.keyvault.jca.certificate-alias-filter-pattern.1='^prod-.*'
+-Dazure.keyvault.jca.certificate-alias-filter-pattern.2='^cert-\d{1,5}$'
+-Dazure.keyvault.jca.certificate-alias-filter-pattern.exclude-old='!.*-old$'
+```
+
+* Use an include pattern directly and an exclude pattern with a `!` prefix.
+* A suffix can be a number or a string. It only keeps the property names unique and does not affect evaluation, so the filters are unordered. Property names are case-sensitive, which means `.prod` and `.PROD` are two different filters.
+* Patterns use full-alias matching (`Pattern.matcher(alias).matches()`).
+* An alias is loaded only if it matches at least one include pattern, or if no include pattern is configured, and matches no exclude pattern.
+* An invalid pattern fails fast with an `IllegalArgumentException` that names the offending pattern.
+
+Quote the value as required by your shell, otherwise characters such as `^` and `\` can be altered before the JVM receives them:
+
+| Shell | Example |
+| --- | --- |
+| Bash, including Git Bash | `-Dazure.keyvault.jca.certificate-alias-filter-pattern.1='^prod-.*'` |
+| PowerShell | `'-Dazure.keyvault.jca.certificate-alias-filter-pattern.1=^prod-.*'` |
+| Windows `cmd.exe` | `"-Dazure.keyvault.jca.certificate-alias-filter-pattern.1=^^prod-.*"` |
+
 ### SSL/TLS
 #### Server side SSL
 If you are looking to integrate the JCA provider to create an SSLServerSocket see the example below.

sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml

@@ -13,12 +13,14 @@
   <suppress files="com.azure.security.keyvault.jca.implementation.KeyVaultClient.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.ClasspathCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.JreCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
+  <suppress files="com.azure.security.keyvault.jca.implementation.certificates.KeyVaultCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.SpecificPathCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.HttpUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.JsonConverterUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.KeyVaultTrustManager.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.KeyVaultClient.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
+  <suppress files="com.azure.security.keyvault.jca.implementation.certificates.KeyVaultCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.signature.AbstractKeyVaultKeylessSignature.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.signature.KeyVaultKeylessRsaSsaPssSignature.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.HttpUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.UseCaughtExceptionCauseCheck" />

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java

@@ -29,7 +29,10 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Properties;
+import java.util.Set;
 import java.util.logging.Logger;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import static java.util.logging.Level.FINE;
@@ -56,6 +59,9 @@ public final class KeyVaultKeyStore extends KeyStoreSpi {
      */
     private static final Logger LOGGER = Logger.getLogger(KeyVaultKeyStore.class.getName());
 
+    static final String CERTIFICATE_ALIAS_FILTER_PATTERN_PROPERTY
+        = "azure.keyvault.jca.certificate-alias-filter-pattern";
+
     /**
      * Stores the Jre key store certificates.
      */
@@ -146,9 +152,10 @@ public KeyVaultKeyStore() {
         customCertificates = SpecificPathCertificates.getSpecificPathCertificates(customPath);
         LOGGER.log(FINE, String.format("Loaded custom certificates: %s.", customCertificates.getAliases()));
 
-        keyVaultCertificates = new KeyVaultCertificates(refreshInterval, keyVaultUri, tenantId, clientId, clientSecret,
-            managedIdentity, accessToken, disableChallengeResourceVerification);
-        LOGGER.log(FINE, String.format("Loaded Key Vault certificates: %s.", keyVaultCertificates.getAliases()));
+        keyVaultCertificates
+            = new KeyVaultCertificates(refreshInterval, keyVaultUri, tenantId, clientId, clientSecret, managedIdentity,
+                accessToken, disableChallengeResourceVerification, getKeyVaultCertificateAliasFilterPatterns());
+        LOGGER.log(FINE, () -> String.format("Loaded Key Vault certificates: %s.", keyVaultCertificates.getAliases()));
 
         classpathCertificates = new ClasspathCertificates();
         LOGGER.log(FINE, String.format("Loaded classpath certificates: %s.", classpathCertificates.getAliases()));
@@ -168,6 +175,22 @@ Long getRefreshInterval() {
             .orElse(0L);
     }
 
+    Set<String> getKeyVaultCertificateAliasFilterPatterns() {
+        // Each pattern gets its own property because any delimiter character can be part of a regex.
+        Properties properties = System.getProperties();
+        String suffixedPropertyPrefix = CERTIFICATE_ALIAS_FILTER_PATTERN_PROPERTY + ".";
+
+        return properties.stringPropertyNames()
+            .stream()
+            .filter(name -> name.equals(CERTIFICATE_ALIAS_FILTER_PATTERN_PROPERTY)
+                || name.startsWith(suffixedPropertyPrefix))
+            .map(properties::getProperty)
+            .filter(Objects::nonNull)
+            .map(String::trim)
+            .filter(pattern -> !pattern.isEmpty())
+            .collect(Collectors.toSet());
+    }
+
     /**
      * get key vault key store by system property
      *
@@ -254,16 +277,22 @@ public boolean engineEntryInstanceOf(String alias, Class<? extends KeyStore.Entr
      */
     @Override
     public Certificate engineGetCertificate(String alias) {
-        Certificate certificate = allCertificates.stream()
-            .map(AzureCertificates::getCertificates)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(certificates -> certificates.get(alias))
-            .orElse(null);
+        Certificate certificate = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                certificate = ((KeyVaultCertificates) certificatesSource).getCertificate(alias);
+            } else {
+                certificate = certificatesSource.getCertificates().get(alias);
+            }
+
+            if (certificate != null) {
+                break;
+            }
+        }
 
         if (refreshCertificatesWhenHaveUnTrustCertificate && certificate == null) {
             keyVaultCertificates.refreshCertificates();
-            certificate = keyVaultCertificates.getCertificates().get(alias);
+            certificate = keyVaultCertificates.getCertificate(alias);
         }
 
         return certificate;
@@ -283,7 +312,7 @@ public String engineGetCertificateAlias(Certificate cert) {
             List<String> aliasList = getAllAliases();
             for (String candidateAlias : aliasList) {
                 Certificate certificate = engineGetCertificate(candidateAlias);
-                if (certificate.equals(cert)) {
+                if (certificate != null && certificate.equals(cert)) {
                     alias = candidateAlias;
                     break;
                 }
@@ -307,16 +336,23 @@ public String engineGetCertificateAlias(Certificate cert) {
      */
     @Override
     public Certificate[] engineGetCertificateChain(String alias) {
-        Certificate[] certificates = allCertificates.stream()
-            .map(AzureCertificates::getCertificateChains)
-            .filter(Objects::nonNull)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(m -> m.get(alias))
-            .orElse(null);
+        Certificate[] certificates = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                certificates = ((KeyVaultCertificates) certificatesSource).getCertificateChain(alias);
+            } else {
+                Certificate[] certificateChain = certificatesSource.getCertificateChains().get(alias);
+                certificates = certificateChain == null ? null : certificateChain.clone();
+            }
+
+            if (certificates != null) {
+                break;
+            }
+        }
+
         if (refreshCertificatesWhenHaveUnTrustCertificate && certificates == null) {
             keyVaultCertificates.refreshCertificates();
-            return keyVaultCertificates.getCertificateChains().get(alias);
+            return keyVaultCertificates.getCertificateChain(alias);
         }
         return certificates;
     }
@@ -358,12 +394,20 @@ public KeyStore.Entry engineGetEntry(String alias, KeyStore.ProtectionParameter
      */
     @Override
     public Key engineGetKey(String alias, char[] password) {
-        return allCertificates.stream()
-            .map(AzureCertificates::getCertificateKeys)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(certificateKeys -> certificateKeys.get(alias))
-            .orElse(null);
+        Key key = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                key = ((KeyVaultCertificates) certificatesSource).getCertificateKey(alias);
+            } else {
+                key = certificatesSource.getCertificateKeys().get(alias);
+            }
+
+            if (key != null) {
+                break;
+            }
+        }
+
+        return key;
     }
 
     /**