|
2 | 2 |
|
3 | 3 | import com.ironcorelabs.tenantsecurity.kms.v1.*; |
4 | 4 | import com.ironcorelabs.tenantsecurity.kms.v1.exception.TenantSecurityException; |
| 5 | +import com.ironcorelabs.tenantsecurity.utils.CompletableFutures; |
5 | 6 | import java.nio.charset.StandardCharsets; |
6 | 7 | import java.util.HashMap; |
7 | 8 | import java.util.Map; |
|
12 | 13 | /** |
13 | 14 | * Three parts: |
14 | 15 | * |
15 | | - * <p>Encrypt a customer record |
| 16 | + * <p> |
| 17 | + * Encrypt a customer record |
16 | 18 | * |
17 | | - * <p>Rekey the encrypted record to a new tenant |
| 19 | + * <p> |
| 20 | + * Rekey the encrypted record to a new tenant |
18 | 21 | * |
19 | | - * <p>Decrypt the encrypted record using the new tenant |
| 22 | + * <p> |
| 23 | + * Decrypt the encrypted record using the new tenant |
20 | 24 | */ |
21 | 25 | public class RekeyExample { |
22 | 26 |
|
@@ -44,87 +48,78 @@ public static void main(String[] args) throws Exception { |
44 | 48 |
|
45 | 49 | // Initialize the client with a Tenant Security Proxy domain and API key. |
46 | 50 | // Typically this would be done once when the application or service initializes. |
47 | | - CompletableFuture<PlaintextDocument> rekeyedRoundtrip = |
48 | | - TenantSecurityClient.create(TSP_ADDR, API_KEY) |
49 | | - .thenCompose( |
50 | | - client -> { |
51 | | - try { |
52 | | - // |
53 | | - // Part 1: Encrypting a customer record |
54 | | - // |
55 | | - |
56 | | - // Create metadata used to associate this document to the first tenant, name the |
57 | | - // document, and identify the service or user making the call |
58 | | - DocumentMetadata metadata = |
59 | | - new DocumentMetadata(TENANT_ID, "serviceOrUserId", "PII"); |
60 | | - |
61 | | - // Create a map containing your data |
62 | | - Map<String, byte[]> custRecord = new HashMap<>(); |
63 | | - custRecord.put("ssn", "000-12-2345".getBytes("UTF-8")); |
64 | | - custRecord.put( |
65 | | - "address", "2825-519 Stone Creek Rd, Bozeman, MT 59715".getBytes("UTF-8")); |
66 | | - custRecord.put("name", "Jim Bridger".getBytes("UTF-8")); |
67 | | - |
68 | | - System.out.println("Encrypting using tenant " + TENANT_ID); |
69 | | - // Request a key from the KMS and use it to encrypt the document |
70 | | - CompletableFuture<EncryptedDocument> encryptedDocument = |
71 | | - client.encrypt(custRecord, metadata); |
72 | | - |
73 | | - // |
74 | | - // Part 2: Rekey the encrypted record to a new tenant |
75 | | - // |
76 | | - |
77 | | - final String NEW_TENANT_ID = "tenant-aws"; |
78 | | - |
79 | | - System.out.println("Rekeying to tenant " + NEW_TENANT_ID); |
80 | | - |
81 | | - CompletableFuture<EncryptedDocument> rekeyedDocument = |
82 | | - encryptedDocument.thenCompose( |
83 | | - // Rekey the document to `tenant-aws` using their primary config. The |
84 | | - // metadata's name and identifying information could also be changed at |
85 | | - // this time. |
86 | | - encrypted -> |
87 | | - client.rekeyEdek(encrypted.getEdek(), metadata, NEW_TENANT_ID) |
88 | | - .thenApply( |
89 | | - newDoc -> |
90 | | - new EncryptedDocument(encrypted.getEncryptedFields(), |
91 | | - newDoc) |
92 | | - )); |
93 | | - |
94 | | - |
95 | | - |
96 | | - // |
97 | | - // Part 3: Decrypt the encrypted record using the new tenant |
98 | | - // |
99 | | - |
100 | | - // Create new metadata for this document indicating that it was |
101 | | - // rekeyed to the second tenant. The name and identifying information |
102 | | - // could also be changed at this time. |
103 | | - DocumentMetadata newMetadata = |
104 | | - new DocumentMetadata(NEW_TENANT_ID, "serviceOrUserId", "PII"); |
105 | | - |
106 | | - System.out.println("Decrypting with tenant " + NEW_TENANT_ID); |
107 | | - |
108 | | - CompletableFuture<PlaintextDocument> decryptedDocument = |
109 | | - rekeyedDocument.thenCompose( |
110 | | - // Decrypt the document encrypted to `tenant-aws` |
111 | | - rekeyed -> client.decrypt(rekeyed, newMetadata)); |
112 | | - |
113 | | - return decryptedDocument; |
114 | | - } catch (Exception e) { |
115 | | - throw new CompletionException(e); |
116 | | - } |
117 | | - }); |
| 51 | + CompletableFuture<PlaintextDocument> rekeyedRoundtrip = CompletableFutures.tryCatchNonFatal( |
| 52 | + () -> new TenantSecurityClient.Builder(TSP_ADDR, API_KEY).allowInsecureHttp(true).build()) |
| 53 | + .thenCompose(client -> { |
| 54 | + try { |
| 55 | + // |
| 56 | + // Part 1: Encrypting a customer record |
| 57 | + // |
| 58 | + |
| 59 | + // Create metadata used to associate this document to the first tenant, name the |
| 60 | + // document, and identify the service or user making the call |
| 61 | + DocumentMetadata metadata = new DocumentMetadata(TENANT_ID, "serviceOrUserId", "PII"); |
| 62 | + |
| 63 | + // Create a map containing your data |
| 64 | + Map<String, byte[]> custRecord = new HashMap<>(); |
| 65 | + custRecord.put("ssn", "000-12-2345".getBytes("UTF-8")); |
| 66 | + custRecord.put("address", |
| 67 | + "2825-519 Stone Creek Rd, Bozeman, MT 59715".getBytes("UTF-8")); |
| 68 | + custRecord.put("name", "Jim Bridger".getBytes("UTF-8")); |
| 69 | + |
| 70 | + System.out.println("Encrypting using tenant " + TENANT_ID); |
| 71 | + // Request a key from the KMS and use it to encrypt the document |
| 72 | + CompletableFuture<EncryptedDocument> encryptedDocument = |
| 73 | + client.encrypt(custRecord, metadata); |
| 74 | + |
| 75 | + // |
| 76 | + // Part 2: Rekey the encrypted record to a new tenant |
| 77 | + // |
| 78 | + |
| 79 | + final String NEW_TENANT_ID = "tenant-aws"; |
| 80 | + |
| 81 | + System.out.println("Rekeying to tenant " + NEW_TENANT_ID); |
| 82 | + |
| 83 | + CompletableFuture<EncryptedDocument> rekeyedDocument = encryptedDocument.thenCompose( |
| 84 | + // Rekey the document to `tenant-aws` using their primary config. The |
| 85 | + // metadata's name and identifying information could also be changed at |
| 86 | + // this time. |
| 87 | + encrypted -> client.rekeyEdek(encrypted.getEdek(), metadata, NEW_TENANT_ID) |
| 88 | + .thenApply( |
| 89 | + newDoc -> new EncryptedDocument(encrypted.getEncryptedFields(), newDoc))); |
| 90 | + |
| 91 | + |
| 92 | + |
| 93 | + // |
| 94 | + // Part 3: Decrypt the encrypted record using the new tenant |
| 95 | + // |
| 96 | + |
| 97 | + // Create new metadata for this document indicating that it was |
| 98 | + // rekeyed to the second tenant. The name and identifying information |
| 99 | + // could also be changed at this time. |
| 100 | + DocumentMetadata newMetadata = |
| 101 | + new DocumentMetadata(NEW_TENANT_ID, "serviceOrUserId", "PII"); |
| 102 | + |
| 103 | + System.out.println("Decrypting with tenant " + NEW_TENANT_ID); |
| 104 | + |
| 105 | + CompletableFuture<PlaintextDocument> decryptedDocument = rekeyedDocument.thenCompose( |
| 106 | + // Decrypt the document encrypted to `tenant-aws` |
| 107 | + rekeyed -> client.decrypt(rekeyed, newMetadata)); |
| 108 | + |
| 109 | + return decryptedDocument; |
| 110 | + } catch (Exception e) { |
| 111 | + throw new CompletionException(e); |
| 112 | + } |
| 113 | + }); |
118 | 114 |
|
119 | 115 | try { |
120 | 116 | // access decrypted fields |
121 | 117 | Map<String, byte[]> decryptedValuesMap = rekeyedRoundtrip.get().getDecryptedFields(); |
122 | 118 |
|
123 | 119 | System.out.println( |
124 | 120 | "Decrypted SSN: " + new String(decryptedValuesMap.get("ssn"), StandardCharsets.UTF_8)); |
125 | | - System.out.println( |
126 | | - "Decrypted address: " |
127 | | - + new String(decryptedValuesMap.get("address"), StandardCharsets.UTF_8)); |
| 121 | + System.out.println("Decrypted address: " |
| 122 | + + new String(decryptedValuesMap.get("address"), StandardCharsets.UTF_8)); |
128 | 123 | System.out.println( |
129 | 124 | "Decrypted name: " + new String(decryptedValuesMap.get("name"), StandardCharsets.UTF_8)); |
130 | 125 | } catch (ExecutionException e) { |
|
0 commit comments