php vault下載php vault源代碼下載

php vault

其他類別

v1.0.7

下載

TechnologyGuru/php-vault

一個靈活的基於PHP的金庫，以動態提供秘密

執照

該項目根據GNU LGPL 3.0許可。

安裝

由作曲家

composer install technicalguru/vault

通過包裝下載

您可以從GitHub發布頁面下載源代碼軟件包

Hashicorp設置

該過程最好在Hashicorp博客中描述。它描述瞭如何創建一個approle 。這是它的本質：

 # Enable the auth method for approle
vault auth enable approle

# Create a renewal policy
echo ' path "auth/token/*" { capabilities = [ "create", "read", "update", "delete", "list", "sudo" ] } ' > renewal-policy.hcl
vault policy write renewal-policy renewal-policy.hcl

# Create a file with your policy on the respective secret path:
cat ' path "secret/my-secret" { capabilities = ["read", "list"] } ' > app-policy.hcl

# Create the policy
vault policy write my-app-policy app-policy.hcl

# Create the approle with renewal-policy and your application policy
vault write auth/approle/role/my-approle token_policies=renewal-policy,my-app-policy token_period=30m token_ttl=30m token_max_ttl=1h token_explicit_max_ttl=2h

# Get the role ID printed
vault read auth/approle/role/my-approle/role-id

# Create the secret ID and print it
vault write -f auth/approle/role/my-approle/secret-id

請注意，每當您更改申請角色或策略時，都需要重新創建秘密ID。

例子

創建HashicorPvault

請注意，該保險庫實際上是現有的Hashicorp庫的客戶端。

 // Create configuration
$ config = array (
	' type '   => ' hashicorp ' ,
	' config ' => array (
		' uri '      => ' https://127.0.0.1:8200/v1 ' ,
		' roleId '   => ' 123456-12345-12345-123456 ' ,
		' secretId ' => ' abcdef-abcde-abcde-abcdef '
	)
);

// Create the vault instance
try {
	$ vault =  TgVault VaultFactory:: create ( $ config );
} catch (  TgVault  VaultException $ e ) {
	// Vault could not be created
}

創建一個存儲器

 // Create configuration
$ config = array (
	' type '   => ' memory ' ,
	' config ' => array (
		' secrets ' => array (
			' my/secret/number/1 ' => array (
				' username ' => ' my-username1 ' ,
				' password ' => ' my-password1 ' ,
			),
			' my/secret/number/2 ' => array (
				' username ' => ' my-username2 ' ,
				' password ' => ' my-password2 ' ,
			),
		)
	)
);

// Create the vault instance
try {
	$ vault =  TgVault VaultFactory:: create ( $ config );
} catch (  TgVault  VaultException $ e ) {
	// Vault could not be created
}

創建一個fileVault

 // Create configuration
$ config = array (
	' type '   => ' file ' ,
	' config ' => array (
		' filename ' => ' path-to-json-secret-file '
	)
);

// Create the vault instance
try {
	$ vault =  TgVault VaultFactory:: create ( $ config );
} catch (  TgVault  VaultException $ e ) {
	// Vault could not be created
}

秘密文件（JSON）看起來像這樣：

{
	"secrets" : {
		"my/secret/number/1" : {
			"username" : " my-username1 " ,
			"password" : " my-password1 "
		},
		"my/secret/number/2" : {
			"username" : " my-username2 " ,
			"password" : " my-password2 "
		}
	}
}

取回秘密

 try {
	$ mySecret1 = $ vault -> getSecret ( ' my/secret/number/1 ' );
	$ mySecret2 = $ vault -> getSecret ( ' my/secret/number/2 ' );
} catch (  TgVault  VaultException $ e ) {
	// secret was not found
}

$ username1 = $ mySecret1 -> get ( ' username ' );
$ password1 = $ mySecret1 -> get ( ' password ' );
$ username2 = $ mySecret2 -> get ( ' username ' );
$ password2 = $ mySecret2 -> get ( ' password ' );

當鍵不存在時，秘密的值是NULL ，而當找不到秘密本身或檢索時出現錯誤時，將拋出異常。

使用懶回調憑據

您可以使用SecretProvider或CredentialsProvider幫助者類來傳遞憑據，而無需知道它們來自何處或如何使用保險庫。

 $ callback1 = new  TgVault  SecretProvider ( $ vault , ' my/secret/number/1 ' );
$ callback2 = new  TgVault  CredentialsProvider ( $ vault , ' my/secret/number/2 ' );

try {
	$ username1 = $ callback1 -> get ( ' username ' );
	$ password1 = $ callback1 -> get ( ' password ' );

	$ username2 = $ callback2 -> getUsername ();
	$ password2 = $ callback2 -> getPassword ();
} catch (  TgVault  VaultException $ e ) {
	// Secret cannot be retrieved or does not exist
}