CredHub manages credentials like passwords, certificates, certificate authorities, ssh keys, rsa keys and arbitrary values (strings and JSON blobs). CredHub provides a CLI and API to get, set, generate and securely store such credentials.
- credhub-cli: command line interface for credhub
- credhub-release: BOSH release of CredHub server
- credhub-acceptance-tests: integration tests written in Go.
Contributing to CredHub
The Cloud Foundry team uses GitHub and accepts contributions via pull request.
Contributor License Agreement
Follow these steps to make a contribution to any of our open source repositories:
Set your name and email (these should match the information on your submitted CLA)
git config --global user.name "Firstname Lastname" git config --global user.email "email@example.com"
Reporting a Vulnerability
We strongly encourage people to report security vulnerabilities privately to our security team before disclosing them in a public forum.
Please note that the e-mail address below should only be used for reporting undisclosed security vulnerabilities in open source Cloud Foundry codebases and managing the process of fixing such vulnerabilities. We cannot accept regular bug reports or other security-related queries at this address.
The e-mail address to use to contact the CFF Security Team is firstname.lastname@example.org.
Our public PGP key can be obtained from a public key server such as pgp.mit.edu. Its fingerprint is: 3FC8 9AF3 940B E270 CF25 E122 9965 0006 EF9D C642. More information can be found at cloudfoundry.org/security.
- Fork the repository
- Create a feature branch (
git checkout -b <my_new_branch>)
- Make changes on your branch
- Test your changes locally (see next section) and in a bosh-lite or other test environment.
- Push to your fork (
git push origin <my_new_branch>) and submit a pull request
We favor pull requests with very small, single commits with a single purpose. Your pull request is much more likely to be accepted if it is small and focused with a clear message that conveys the intent of your change.
Generating API Documentation
The CredHub API can generate API documentation by running its test suite (via Spring Rest Docs). CredHub API Documentation can be generated as follows:
CredHub API documentation will be built as an html file in the CredHub backend gradle subproject build directory:
Launching in production directly using the
bootRun target is unsafe, as you will launch with a
dev profile, which has checked-in secret keys in
A dependency graph of project components (gradle subprojects) can be generated to better understand project organization. You will need graphviz installed on your system in order to generate the graph.
Configuration for the server is spread across the
- Configuration shared by all environments (dev, test, or BOSH-deployed) is in
- Development-specific configuration is in
application-dev.yml. This includes:
- A UAA URL intended for development use only,
- A JWT public verification key for use with that UAA, and
dev-keys intended for development use only.
- Per-database configuration is placed in
application-dev-postgres.yml. For convenience, these per-database profiles include the
By default, CredHub launches with the
dev profiles enabled.
Oracle JDK vs OpenJDK
CredHub relies on the JDK to have uncrippled cryptographic capability -- in the Oracle JDK, this requires the slightly deceptively named "Unlimited Strength Jurisdiction Policy".
By default, OpenJDK ships with "Unlimited Strength". Our credhub-release uses OpenJDK, and so inherits the full-strength capability.
But the Oracle JDK is often installed on workstations and does not have the Unlimited Strength policy.
How can I tell?
If you see an error like
java.security.InvalidKeyException: Illegal key size, you probably haven't installed the additional policy for the Oracle JDK. CredHub is trying to use 256-bit keys, but is being blocked by the default policy.
Oracle makes the Unlimited Strength policy available for separate download here.
Assuming you are on OS X, you can then run:
unzip ~/Downloads/jce_policy-8.zip -d /tmp sudo cp /tmp/UnlimitedJCEPolicyJDK8/*.jar "$(/usr/libexec/java_home)/jre/lib/security/"
You will need to restart CredHub locally for changes to take effect.
UAA and the JWT public signing key
CredHub requires a UAA server to manage authentication.
application-dev.yml there are two relevant settings:
auth-server.url. This needs to point to a running UAA server (remote or BOSH-lite, it's up to you).
security.oauth2.resource.jwt.key-value. This is the public verification key, corresponding to a private JWT signing key held by your UAA server.
For convenience, the CredHub team runs a public UAA whose IP is in the default
application-dev.yml manifest. The password grant values are
password and the client credentials grant value are
secret. This public UAA is for local development usage only! You will need to skip SSL validation in order to use it.
Running CredHub with local UAA
In order to run CredHub against a UAA running on your local machine, do the following:
- Start a UAA with Docker:
docker run -d --mount type=bind,source=$PWD/config/uaa.yml,target=/uaa/uaa.yml -p 127.0.0.1:8080:8080 pcfseceng/uaa:latest
- Start CredHub server pointing at the local UAA:
For testing purposes, the local UAA bootstraps a user (username:
password) and a client (client ID:
credhub_client / client secret:
secret), with which you can access the local CredHub. For example:
# log into CredHub CLI using a UAA client; this client comes with permissions to access all CredHub credential paths (see `application-dev.yml` manifest) credhub login -s https://localhost:9000 --client-name=credhub_client --client-secret=secret --skip-tls-validation # log into CredHub CLI using a UAA user; this user does not come with permissions to CredHub credential paths (see `application-dev.yml` manifest) credhub login -s https://localhost:9000 -u credhub -p password --skip-tls-validation
Starting the server with different databases
H2 (the default)
H2 datasource configuration is in
Postgres datasource configuration is in
Before development, you'll need to create the target database.
Then to run in development mode with Postgres
MySQL datasource configuration is in
Log into your MySQL server and create databases
credhub_test with privileges granted to
mysql -u root create database credhub_test; create database credhub_dev;
If you're on a Mac using Homebrew and you run into a problem where you install MySQL and it isn't running (i.e.,
mysql -u root errors with a socket error), you may need to uninstall mysql, delete the
/usr/local/var/mysql directory (Warning: this will delete all local MySQL data!), and then reinstall MySQL.
Alternatively, you can also start a local MySQL server with docker:
docker run \ --name mysql-server \ --env MYSQL_ALLOW_EMPTY_PASSWORD='yes' \ --env MYSQL_ROOT_HOST='%' \ --publish 3306:3306 \ --detach \ "mysql:8.0"
Then to run in development mode with MySQL:
Debugging the server
To load JDWP agent for credhub jvm debugging, start the server as follows:
You can then attach your debugger to port 5005 of the jvm process.
To suspend the server start-up until the debugger is attached (useful for debugging start-up code), start the server as follows:
Running tests with different databases
Testing with different databases requires you to set a system property with the profile corresponding to your desired database. For example, to test with H2, you'll need to run the tests with the
During development, it is helpful to set up different IntelliJ testing profiles that use the following VM Options:
-ea -Dspring.profiles.active=unit-test-h2for testing with H2
-ea -Dspring.profiles.active=unit-test-mysqlfor testing with MySQL
-ea -Dspring.profiles.active=unit-test-postgresfor testing with Postgres
Testing with the CLI and Acceptance Tests
Using the CLI locally
After having pulled the credhub-cli repo, run
make, and then run the following command to target your locally running CredHub instance:
build/credhub login -s https://localhost:9000 --client-name=credhub_client --client-secret=secret --skip-tls-validation
Running the Acceptance Tests
First, be sure to pull and compile the credhub-cli, as described above.
Make sure your development server is running. When it starts up for the first time, it will create a server CA and server certificate for SSL, as well as a trusted client CA for testing mutual TLS authentication. These will be located in
src/test/resources relative to the
Pull credhub-acceptance-tests and run:
Assuming it works, that will generate some test client certificates for testing mutual TLS (in
certs/ in the acceptance test directory) and run the acceptance test suite against your locally running credhub server.
Setting up FindBugs in Intellij
- Goto Preferences -> Plugins
- Search for and install FindBugs
- Goto Preferences -> Other Settings -> FindBugs-IDEA
- Click on import button and import config/findbugs/findbugs-idea.xml
Find Security Bugs
- Click on filters
Exclude filter filesand select config/findbugs/findbugs-filter.xml