Add support for secret file credentials (#246)

* add support for secret file type of credentials

* Add documentation

* adjust the default fileName of credentials of type secret-file

Author: ysmaoui

README.md

@@ -15,7 +15,7 @@ The plugin acts as an Azure Active Directory Application and must be configured
 
 In the Jenkins **Configure System** page, configure the following two options in the **Azure Key Vault Plugin** section
 * **Key Vault URL** - The url where your Key Vault resides (e.g. `https://myvault.vault.azure.net/`)
-* **Credential ID** - The ID associated with a secret in the Jenkins secret store. Supported types are: 
+* **Credential ID** - The ID associated with a secret in the Jenkins secret store. Supported types are:
     - **Azure Service Principal**
     - **Azure Managed Identity** (both user and system assigned)
 
@@ -144,7 +144,7 @@ node {
 With overrides:
 ```groovy
 static LinkedHashMap<String, Object> secret(String secretName, String envVar) {
-  [ 
+  [
     secretType: 'Secret',
     name: secretName,
     version: '342432lkjhdasjld',
@@ -158,7 +158,7 @@ node {
     ]
 
     withAzureKeyvault(
-            azureKeyVaultSecrets: secrets, 
+            azureKeyVaultSecrets: secrets,
             keyVaultURLOverride: 'https://mykeyvault.vault.azure.net',
             credentialIDOverride: 'service-principal'
     ) {
@@ -199,8 +199,8 @@ pipeline {
         stage('Build') {
             options {
               azureKeyVault(
-                credentialID: 'my-sp', 
-                keyVaultURL: 'https://my.vault.azure.net', 
+                credentialID: 'my-sp',
+                keyVaultURL: 'https://my.vault.azure.net',
                 secrets: [
                     [envVariable: 'MY_SECRET', name: 'my-secret', secretType: 'Secret']
                 ]
@@ -254,9 +254,13 @@ To use a different type add a tag called `type` with one of the below values:
 - `string` - Secret text
 - `username` - Username with password
   - add a tag `username` for the username of the credential
+- `secretFile` - a file with secret content
+  - (optional) add a tag `fileName`  for the secret file name, when it is fetched. Default is `${secretNameIntheVault}.txt`.
 - `sshUserPrivateKey` - SSH Private key
   - add a tag `username` for the username of the credential
-  - (optional) add a tag `username-is-secret` and set it to true to hide the username in the build logs 
+  - (optional) add a tag `username-is-secret` and set it to true to hide the username in the build logs
+
+#### Secret String
 
 Declarative Pipeline:
 
@@ -295,7 +299,7 @@ az keyvault secret set --vault-name my-vault \
   --tags username=github-user type=username
 ```
 
-Scripted Pipeline:  
+Scripted Pipeline:
 ```groovy
 job('my example') {
     scm {
@@ -309,6 +313,26 @@ job('my example') {
 }
 ```
 
+#### Secret file
+
+```bash
+az keyvault secret set --vault-name my-vault \
+  --name a-secret-file-vault-secret \
+  --value "-----BEGIN test secretFile-----\nline 1\nline2\nbla\nblob" \
+  --tags type=secretFile fileName=mySecretFile.txt
+```
+
+Scripted Pipeline:
+```groovy
+node {
+    withCredentials([
+      file(credentialsId: "test-secretFile-credentialsId", variable: "VARIABLE_CONTAINING_PATH_TO_SECRET_FILE")]) {
+      sh("doSomething --use-this-secret-file \$VARIABLE_CONTAINING_PATH_TO_SECRET_FILE")
+    }
+}
+```
+
+
 #### SSH Username with private key
 
 ```bash
@@ -381,7 +405,7 @@ If the passphrase can not be found in the vault, the secret will not load and a
 
 You can filter which secrets are visible to the credentials provider.
 By default, the plugin will load all secrets stored within the Key Vault.
-However, your Key Vault may be the Secret Source for multiple applications, or contains secrets not needed directly by Jenkins. 
+However, your Key Vault may be the Secret Source for multiple applications, or contains secrets not needed directly by Jenkins.
 To filter out secrets from being set, add a System Property or Environment Variable:
 
 **Via System Property**:

src/main/java/org/jenkinsci/plugins/azurekeyvaultplugin/AzureCredentialsProvider.java

@@ -38,6 +38,7 @@
 import jenkins.model.Jenkins;
 import org.acegisecurity.Authentication;
 import org.apache.commons.lang3.StringUtils;
+import org.jenkinsci.plugins.azurekeyvaultplugin.credentials.secretfile.AzureSecretFileCredentials;
 import org.jenkinsci.plugins.azurekeyvaultplugin.credentials.sshuserprivatekey.AzureSSHUserPrivateKeyCredentials;
 import org.jenkinsci.plugins.azurekeyvaultplugin.credentials.string.AzureSecretStringCredentials;
 import org.jenkinsci.plugins.azurekeyvaultplugin.credentials.usernamepassword.AzureUsernamePasswordCredentials;
@@ -189,6 +190,15 @@ private static Collection<IdCredentials> fetchCredentials() {
                             credentials.add(cred);
                             break;
                         }
+                        case "secretFile": {
+                            String fileName = tags.get("fileName");
+                            if(fileName.isEmpty()){
+                                fileName = getSecretName(id) + ".txt";
+                            }
+                            AzureSecretFileCredentials cred = new AzureSecretFileCredentials(scope, jenkinsID, description, fileName, new KeyVaultSecretRetriever(client, id));
+                            credentials.add(cred);
+                            break;
+                        }
                         case "username": {
                             AzureUsernamePasswordCredentials cred = new AzureUsernamePasswordCredentials(
                                     scope, jenkinsID, tags.get("username"), description, new KeyVaultSecretRetriever(client, id)

src/main/java/org/jenkinsci/plugins/azurekeyvaultplugin/credentials/secretfile/AzureSecretFileCredentials.java

@@ -0,0 +1,68 @@
+package org.jenkinsci.plugins.azurekeyvaultplugin.credentials.secretfile;
+
+import com.cloudbees.plugins.credentials.CredentialsProvider;
+import com.cloudbees.plugins.credentials.CredentialsScope;
+import com.cloudbees.plugins.credentials.impl.BaseStandardCredentials;
+import edu.umd.cs.findbugs.annotations.NonNull;
+import hudson.Extension;
+import hudson.util.Secret;
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.function.Supplier;
+import org.jenkinsci.plugins.azurekeyvaultplugin.AzureCredentialsProvider;
+import org.jenkinsci.plugins.plaincredentials.FileCredentials;
+import org.jenkinsci.plugins.plaincredentials.impl.Messages;
+import org.jvnet.localizer.ResourceBundleHolder;
+
+public class AzureSecretFileCredentials extends BaseStandardCredentials implements FileCredentials {
+
+    @NonNull
+    private final String fileName;
+
+    @NonNull
+    private final Supplier<Secret> secretBytes;
+
+    public AzureSecretFileCredentials(
+        CredentialsScope scope,
+        String id,
+        String description,
+        String fileName,
+        Supplier<Secret> secretBytes
+    ) {
+        super(scope, id, description);
+        this.fileName = fileName;
+        this.secretBytes = secretBytes;
+    }
+
+    @NonNull
+    @Override
+    public String getFileName() {
+        return fileName;
+    }
+
+    @NonNull
+    @Override
+    public InputStream getContent() throws java.io.UnsupportedEncodingException {
+        String fileContent = Secret.toString(getSecretBytes());
+        return new ByteArrayInputStream(fileContent.getBytes("UTF-8"));
+    }
+
+    public Secret getSecretBytes() {
+        return secretBytes.get();
+    }
+
+    @Extension
+    @SuppressWarnings("unused")
+    public static class DescriptorImpl extends BaseStandardCredentialsDescriptor {
+        @Override
+        @NonNull
+        public String getDisplayName() {
+            return ResourceBundleHolder.get(Messages.class).format("FileCredentialsImpl.secret_file");
+        }
+
+        @Override
+        public boolean isApplicable(CredentialsProvider provider) {
+            return provider instanceof AzureCredentialsProvider;
+        }
+    }
+}

src/main/java/org/jenkinsci/plugins/azurekeyvaultplugin/credentials/secretfile/AzureSecretFileCredentialsSnapshotTaker.java

@@ -0,0 +1,33 @@
+package org.jenkinsci.plugins.azurekeyvaultplugin.credentials.secretfile;
+
+import com.cloudbees.plugins.credentials.CredentialsSnapshotTaker;
+import hudson.Extension;
+import hudson.util.Secret;
+import org.jenkinsci.plugins.azurekeyvaultplugin.credentials.Snapshot;
+
+@Extension
+@SuppressWarnings("unused")
+public class AzureSecretFileCredentialsSnapshotTaker extends CredentialsSnapshotTaker<AzureSecretFileCredentials> {
+    @Override
+    public Class<AzureSecretFileCredentials> type() {
+        return AzureSecretFileCredentials.class;
+    }
+
+    @Override
+    public AzureSecretFileCredentials snapshot(AzureSecretFileCredentials credential) {
+        SecretSnapshot secretSnapshot = new SecretSnapshot(credential.getSecretBytes());
+        return new AzureSecretFileCredentials(
+            credential.getScope(),
+            credential.getId(),
+            credential.getDescription(),
+            credential.getFileName(),
+            secretSnapshot
+        );
+    }
+
+    private static class SecretSnapshot extends Snapshot<Secret> {
+        SecretSnapshot(Secret value) {
+            super(value);
+        }
+    }
+}