diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
index 9afd78ac..8d1a0f89 100644
--- a/.github/workflows/run-tests.yaml
+++ b/.github/workflows/run-tests.yaml
@@ -13,10 +13,6 @@ jobs:
AWS_REGION: ${{ secrets.TEST_AWS_REGION }}
AWS_ACCESS_KEY_ID: ${{ secrets.TEST_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.TEST_AWS_SECRET_ACCESS_KEY }}
- VAULT_ADDR: ${{ secrets.TEST_VAULT_ADDR }}
- HCP_ORG_ID: ${{ secrets.TEST_HCP_ORG_ID }}
- HCP_PROJECT_ID: ${{ secrets.TEST_HCP_PROJECT_ID }}
- HCP_APP_NAME: ${{ secrets.TEST_HCP_APP_NAME }}
steps:
- name: Checkout the repository
uses: actions/checkout@v4
@@ -142,25 +138,6 @@ jobs:
echo "${{ secrets.TEST_GCP_CONFIG }}" > $HOME/.gcp/config.json
echo "${{ secrets.GCP_TEST_PROPERTIES }}" > ojdbc-provider-gcp/test.properties
- # Generate ojdbc-provider-hashicorp/test.properties
- echo -e "VAULT_ADDR=${{ secrets.TEST_VAULT_ADDR }}\n
- DEDICATED_VAULT_SECRET_PATH=${{ secrets.TEST_DEDICATED_VAULT_SECRET_PATH }}\n
- DEDICATED_VAULT_SECRET_PATH_WITH_MULTIPLE_KEYS=${{ secrets.TEST_DEDICATED_VAULT_SECRET_PATH_WITH_MULTIPLE_KEYS }}\n
- VAULT_USERNAME=${{ secrets.TEST_VAULT_USERNAME }}\n
- VAULT_PASSWORD=${{ secrets.TEST_VAULT_PASSWORD }}\n
- VAULT_NAMESPACE=${{ secrets.TEST_VAULT_NAMESPACE }}\n
- ROLE_ID=${{ secrets.TEST_ROLE_ID }}\n
- SECRET_ID=${{ secrets.TEST_SECRET_ID }}\n
- GITHUB_TOKEN=${{ secrets.TEST_GITHUB_TOKEN }}\n
- KEY=${{ secrets.TEST_KEY }}\n
- HCP_ORG_ID=${{ secrets.TEST_HCP_ORG_ID }}\n
- HCP_PROJECT_ID=${{ secrets.TEST_HCP_PROJECT_ID }}\n
- HCP_APP_NAME=${{ secrets.TEST_HCP_APP_NAME }}\n
- HCP_CLIENT_ID=${{ secrets.TEST_HCP_CLIENT_ID }}\n
- HCP_CLIENT_SECRET=${{ secrets.TEST_HCP_CLIENT_SECRET }}\n
- SECRET_NAME=${{ secrets.TEST_SECRET_NAME }}\n
- SECRET_NAME_WITH_MULTIPLE_KEYS=${{ secrets.TEST_SECRET_NAME_WITH_MULTIPLE_KEYS }}\n
- " >> ojdbc-provider-hashicorp/test.properties
- name: Run tests with Maven
run: mvn -B test --file pom.xml
@@ -180,5 +157,4 @@ jobs:
rm ojdbc-provider-jackson-oson/test.properties
- rm ojdbc-provider-aws/test.properties
- rm ojdbc-provider-hashicorp/test.properties
+ rm ojdbc-provider-aws/test.properties
\ No newline at end of file
diff --git a/ojdbc-provider-aws/README.md b/ojdbc-provider-aws/README.md
index 8697cf56..c9157ad0 100644
--- a/ojdbc-provider-aws/README.md
+++ b/ojdbc-provider-aws/README.md
@@ -136,7 +136,6 @@ For the JSON type of provider (AWS S3, AWS Secrets Manager, AWS Parameter Store,
- `awssecretsmanager` (AWS Secrets Manager)
- `awsparameterstore` (AWS Parameter Store)
- `hcpvaultdedicated` (HCP Vault Dedicated)
- - `hcpvaultsecret` (HCP Vault Secrets)
- `gcpsecretmanager` (GCP Secret Manager)
- `value`
- Mandatory
@@ -147,7 +146,6 @@ For the JSON type of provider (AWS S3, AWS Secrets Manager, AWS Parameter Store,
- AWS Secret name (if awssecretsmanager)
- AWS Parameter name (if awsparameterstore)
- Secret path (if hcpvaultdedicated)
- - Secret name (if hcpvaultsecret)
- Secret name (if gcpsecretmanager)
- `field_name`
- Optional
diff --git a/ojdbc-provider-azure/README.md b/ojdbc-provider-azure/README.md
index cf9abcf9..6e468b95 100644
--- a/ojdbc-provider-azure/README.md
+++ b/ojdbc-provider-azure/README.md
@@ -115,7 +115,6 @@ For the JSON type of provider (Azure Key Vault, HTTP/HTTPS, File) the password i
- `base64` (Base64)
- `awssecretsmanager` (AWS Secrets Manager)
- `hcpvaultdedicated` (HCP Vault Dedicated)
- - `hcpvaultsecret` (HCP Vault Secrets)
- `gcpsecretmanager` (GCP Secret Manager)
- `value`
- Mandatory
@@ -125,7 +124,6 @@ For the JSON type of provider (Azure Key Vault, HTTP/HTTPS, File) the password i
- Base64 Encoded password (if base64)
- AWS Secret name (if awssecretsmanager)
- Secret path (if hcpvaultdedicated)
- - Secret name (if hcpvaultsecret)
- Secret name (if gcpsecretmanager)
- `authentication`
- Optional
diff --git a/ojdbc-provider-gcp/README.md b/ojdbc-provider-gcp/README.md
index bad1cce5..7f4db538 100644
--- a/ojdbc-provider-gcp/README.md
+++ b/ojdbc-provider-gcp/README.md
@@ -146,7 +146,6 @@ For the JSON type of provider (GCP Object Storage, HTTP/HTTPS, File) the passwor
- `base64` (Base64)
- `awssecretsmanager` (AWS Secrets Manager)
- `hcpvaultdedicated` (HCP Vault Dedicated)
- - `hcpvaultsecret` (HCP Vault Secrets)
- `value`
- Mandatory
- Possible values
@@ -156,7 +155,6 @@ For the JSON type of provider (GCP Object Storage, HTTP/HTTPS, File) the passwor
- Base64 Encoded password (if base64)
- AWS Secret name (if awssecretsmanager)
- Secret path (if hcpvaultdedicated)
- - Secret name (if hcpvaultsecret)
- `authentication`
- Optional
- Possible Values
diff --git a/ojdbc-provider-hashicorp/README.md b/ojdbc-provider-hashicorp/README.md
index 4770d279..a3dc99f7 100644
--- a/ojdbc-provider-hashicorp/README.md
+++ b/ojdbc-provider-hashicorp/README.md
@@ -6,8 +6,6 @@ and HashiCorp Vault (HCP).
## Centralized Config Providers
- HashiCorp Vault Dedicated Config Provider
-- Provides connection properties managed by the Vault Secrets service
-- HashiCorp Vault Secret Config Provider
- Provides connection properties managed by the Dedicated Vault service
- Caching configuration
- Caching mechanism adopted by Centralized Config Providers
@@ -17,28 +15,16 @@ and HashiCorp Vault (HCP).
- Dedicated Vault Username Provider
- Provides a username stored in a HashiCorp Vault Dedicated.
-- HCP Vault Secrets Username Provider
-- Provides a username stored in HashiCorp Vault Secrets.
- Dedicated Vault Password Provider
- Provides a password stored in a HashiCorp Vault Dedicated.
-- HCP Vault Secrets Password Provider
-- Provides a password stored in HashiCorp Vault Secrets.
- Dedicated Vault TCPS Wallet Provider
- Provides TLS wallets from HashiCorp Vault Dedicated for secure connections.
-- HCP Vault Secrets TCPS Wallet Provider
-- Provides TLS wallets from HashiCorp Vault Secrets for secure connections.
- Dedicated Vault SEPS Wallet Provider
- Provides SEPS (Secure External Password Store) wallets for secure username and password retrieval from HashiCorp Vault Dedicated.
-- HCP Vault Secrets SEPS Wallet Provider
-- Provides SEPS (Secure External Password Store) wallets for secure username and password retrieval from HashiCorp Vault Secrets.
- Dedicated Vault Connection String Provider
- Provides connection strings based on aliases stored in a `tnsnames.ora` file within HashiCorp Vault Dedicated.
-- HCP Vault Secrets Connection String Provider
-- Provides connection strings based on aliases stored in a `tnsnames.ora` file within HashiCorp Vault Secrets.
- Common Parameters for HCP Vault Dedicated Resource Providers
- Defines common configuration parameters for providers using HCP Vault Dedicated.
-- Common Parameters for HCP Vault Secrets Resource Providers
-- Defines common parameters for all providers using HCP Vault Secrets.
- Configuring Authentication for Resource Providers
- Details supported authentication methods and usage instructions.
@@ -63,8 +49,8 @@ The coordinates for the latest release are:
## Authentication
Providers use the HashiCorp Vault API to retrieve secrets and configurations.
-The HashiCorp Vault Providers support two types of Vaults: **HCP Vault Dedicated** and **HCP Vault Secrets**.
-Each type supports multiple authentication methods, each requiring specific parameters.
+The HashiCorp Vault Providers support **HCP Vault Dedicated** with multiple authentication methods,
+each requiring specific parameters.
The provider searches for these parameters in the following locations in a predefined sequence:
@@ -259,155 +245,11 @@ The provider automatically detects the available parameters and chooses the best
**Note:** If no authentication method is explicitly specified, **AUTO_DETECT is used by default.**
-
-### HCP Vault Secrets
-
-Authentication for **HCP Vault Secrets** supports multiple methods:
-
-Below is an overview of the supported authentication methods:
-
-1. **OAuth 2.0 Client Credentials Flow**
- - Uses `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` to obtain a Bearer token for authentication.
- - The token is then used to retrieve secrets from HCP Vault Secrets API.
-
-2. **Credentials File Authentication**
- - Uses a JSON file (`creds-cache.json`) containing authentication credentials (`access_token`, `refresh_token`, and `access_token_expiry`).
- - If the access token is expired, it is automatically refreshed using the stored refresh token.
- - If the access token is expired, it is **automatically refreshed** using the stored refresh token.
-
-The generated token is cached and reused until it expires, minimizing API calls to HCP Vault Secrets.
-
-Secrets are retrieved from the following API endpoint:
-`https://api.cloud.hashicorp.com/secrets/2023-11-28/organizations/$HCP_ORG_ID/projects/$HCP_PROJECT_ID/apps/$APP_NAME/secrets`
-
-For more information, visit the official HashiCorp Vault documentation: [HCP Vault Secrets](https://developer.hashicorp.com/hcp/tutorials/get-started-hcp-vault-secrets/hcp-vault-secrets-retrieve-secret).
-
-#### OAuth 2.0 Client Credentials Flow
-
-This method uses OAuth 2.0 **client credentials** to obtain a **Bearer token**, which is required for authentication.
-The provider searches for the following parameters:
-
-
-
-
-Parameter Name |
-Description |
-Required |
-
-
-
-
-HCP_CLIENT_ID |
-The client ID for OAuth 2.0 authentication |
-Yes |
-
-
-HCP_CLIENT_SECRET |
-The client secret for OAuth 2.0 authentication |
-Yes |
-
-
-
-
-In addition to the above parameters, the Common parameters
-are also required.
-
-#### CLI CREDENTIALS FILE
-This method **retrieves authentication details** from a **JSON file (`creds-cache.json`)** that contains access tokens.
-
-- If **HCP CLI is installed**, a **creds-cache.json** file is **automatically created** in: ~/.config/hcp/creds-cache.json
-- This file contains **access_token, refresh_token, and access_token_expiry**.
-- If **the token is expired**, it is **automatically refreshed** using the **refresh_token**.
-- The credentials file should be a JSON file containing the following structure:
-
-```json
-{
- "login": {
- "access_token": "YOUR_ACCESS_TOKEN",
- "refresh_token": "YOUR_REFRESH_TOKEN",
- "access_token_expiry": "2025-01-01T12:34:56.789Z"
- }
-}
-```
-- access_token: The current access token for API authentication.
-- refresh_token: The refresh token used to obtain a new access token when expired.
-- access_token_expiry: The expiration timestamp of the access_token.
-
-When using this method, the provider will:
- * Read the file and validate the access_token.
- * Refresh the token if it's expired, using the refresh_token.
- * Update the file with the new token details.
-
-The provider searches for the following parameters:
-
-
-
-
-Parameter Name |
-Description |
-Required |
-
-
-
-
-HCP_CREDENTIALS_FILE |
-The path of the credentials file ( by default ~/.config/hcp/creds-cache.json |
-No |
-
-
-
-
-In addition to the above parameters, the Common parameters
-are also required.
-
-#### AUTO_DETECT Authentication
-
-The **AUTO_DETECT** authentication method dynamically selects the most suitable authentication mechanism based on the provided parameters.
-This eliminates the need for users to manually specify an authentication method, ensuring a seamless and efficient authentication process.
-
-#### Selection Order:
-1. **CLI_CREDENTIALS_FILE** → If `HCP_CREDENTIALS_FILE` is provided or the default credentials file (`~/.config/hcp/creds-cache.json`) exists, it is used.
-2. **CLIENT_CREDENTIALS** → If `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` are available, Client Credentials authentication is used as a fallback.
-
-The provider automatically detects the available parameters and chooses the best authentication method accordingly.
-
-**Note:** If no authentication method is explicitly specified, **AUTO_DETECT is used by default.**
-
-#### Common Parameters for HCP Vault Secrets authentication methods
-
-
-
-
-Parameter Name |
-Description |
-Required |
-
-
-
-
-HCP_ORG_ID |
-The organization ID associated with the Vault |
-Yes |
-
-
-HCP_PROJECT_ID |
-The project ID associated with the Vault |
-Yes |
-
-
-HCP_APP_NAME |
-The application name in HCP Vault Secrets |
-Yes |
-
-
-
-
-
## Config Providers
### HCP Vault Dedicated Config Provider
-The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpdedicatedvault://` to be able to identify that the configuration parameters should be loaded using HCP Vault Dedicated. Users need to indicate the secret path with the following syntax:
+The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpvaultdedicated://` to be able to identify that the configuration parameters should be loaded using HCP Vault Dedicated. Users need to indicate the secret path with the following syntax:
jdbc:oracle:thin:@config-hcpvaultdedicated://{secret-path}[?option1=value1&option2=value2...]
@@ -426,28 +268,6 @@ The query parameters (`option1=value1`, `option2=value2`, etc.) are optional key
jdbc:oracle:thin:@config-hcpvaultdedicated:///v1/namespace/secret/data/secret_name?KEY=sales_app1&authentication=approle
```
-### HCP Vault Secrets Config Provider
-
-The Oracle DataSource uses a new prefix `jdbc:oracle:thin:@config-hcpvaultsecret://` to identify that the configuration parameters should be loaded using HCP Vault Secrets. Users need to indicate the secret name (`SECRET_NAME`) with the following syntax:
-
-
-jdbc:oracle:thin:@config-hcpvaultsecret://{secret-name}[?option1=value1&option2=value2...]
-
-
-The `secret-name` refers to the name of the secret to retrieve from HCP Vault Secrets
-
-The query parameters (`option1=value1`, `option2=value2`, etc.) are optional key-value pairs that can be used to:
-
-- Specify authentication parameters (e.g., `HCP_CLIENT_ID`, `HCP_ORG_ID`)
-- Pass additional context information required by the provider
-
-All parameters that can be specified as environment variables or system properties can also be provided directly in the URL.
-
-For example:
-```
-jdbc:oracle:thin:@config-hcpvaultsecret://secret-name?HCP_APP_NAME=app-name&key=sales_app1
-```
-
### JSON Payload format
There are 4 fixed values that are looked at the root level:
@@ -501,53 +321,14 @@ The sample code below executes as expected with the previous configuration.
System.out.println("select sysdate from dual: " + rs.getString(1));
```
-For **HCP Vault Secrets**
-For example, let's suppose a URL like:
-
- jdbc:oracle:thin:@config-hcpvaultsecret://secret-name
-And the JSON Payload for a secret stored within the application app_name in the HCP Vault Secrets would look like the following:
-
-```json
-{
- "connect_descriptor": "(description=(retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1521)(host=adb.us-phoenix-1.oraclecloud.com))(connect_data=(service_name=xsxsxs_dbtest_medium.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)))",
- "user": "scott",
- "password": {
- "type": "hcpvaultsecret",
- "value": "secret-name"
- },
- "wallet_location": {
- "type": "hcpvaultsecret",
- "value": "wallet-secret"
- },
- "jdbc": {
- "oracle.jdbc.ReadTimeout": 1000,
- "defaultRowPrefetch": 20,
- "autoCommit": "false"
- }
-}
-```
-
-The sample code below executes as expected with the previous configuration.
-
-```java
- OracleDataSource ds = new OracleDataSource();
- ds.setURL("jdbc:oracle:thin:@config-hcpvaultsecret://secret-name");
- Connection cn = ds.getConnection();
- Statement st = cn.createStatement();
- ResultSet rs = st.executeQuery("select sysdate from dual");
- if (rs.next())
- System.out.println("select sysdate from dual: " + rs.getString(1));
-```
-
### Password JSON Object
-For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTPS, File), the password is an object itself with the following spec:
+For the JSON type of provider (HCP Vault Dedicated, HTTP/HTTPS, File), the password is an object itself with the following spec:
- `type`
- Mandatory
- Possible values
- `hcpvaultdedicated` (HCP Vault Dedicated)
- - `hcpvaultsecret` (HCP Vault Secrets)
- `ocivault` (OCI Vault)
- `azurevault` (Azure Key Vault)
- `base64` (Base64)
@@ -557,13 +338,12 @@ For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTP
- Mandatory
- Possible values
- Secret path (if hcpvaultdedicated)
- - Secret name (if hcpvaultsecret)
- OCID of the secret (if ocivault)
- Azure Key Vault URI (if azurevault)
- Base64 Encoded password (if base64)
- AWS Secret name (if awssecretsmanager)
- Secret name (if gcpsecretmanager)
-- `field_name` (HCP Vault Dedicated only)
+- `field_name` (HCP Vault Dedicated)
- Optional
- Description: Specifies the key within the secret JSON object to retrieve the password value.
For example, if the secret contains `{ "db-password": "mypassword" }`,
@@ -582,7 +362,7 @@ For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTP/HTTP
The `oracle.net.wallet_location` connection property is not allowed in the `jdbc` object due to security reasons. Instead, users should use the `wallet_location` object to specify the wallet in the configuration.
-For the JSON type of provider (HCP Vault Dedicated, HCP Vault Secrets, HTTPS, File) the `wallet_location` is an object itself with the same spec as the [password JSON object](#password-json-object) mentioned above.
+For the JSON type of provider (HCP Vault Dedicated, HTTPS, File) the `wallet_location` is an object itself with the same spec as the [password JSON object](#password-json-object) mentioned above.
The value stored in the secret should be the Base64 representation of a supported wallet file. This is equivalent to setting the `oracle.net.wallet_location` connection property in a regular JDBC application using the following format:
@@ -604,7 +384,7 @@ This property should be included inside the jdbc object of the JSON payload:
}
```
-*Note: When storing a wallet in HCP Vault Dedicated or HCP Vault Secrets, store the raw Base64-encoded wallet bytes directly. The provider will automatically detect and handle the encoding correctly.
+*Note: When storing a wallet in HCP Vault Dedicated, store the raw Base64-encoded wallet bytes directly. The provider will automatically detect and handle the encoding correctly.
## Resource Providers
@@ -663,34 +443,6 @@ If omitted and multiple keys exist, an error is thrown.
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties).
-### HCP Vault Secrets Username Provider
-
-The **HCP Vault Secrets Username Provider** provides Oracle JDBC with a **database username** that is managed by **HashiCorp Vault Secrets**.
-This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-username`.
-
-In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-Default Value |
-
-
-
-
-secretName |
-The name of the secret in HCP Vault Secrets containing the username. |
-Any valid secret name within the app. |
- No default value. A value must be configured for this parameter. |
-
-
-
-
-An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties).
-
---
### Dedicated Vault Password Provider
@@ -749,34 +501,6 @@ If omitted and multiple keys exist, an error is thrown.
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties).
-### HCP Vault Secrets Password Provider
-
-The **HCP Vault Secrets Password Provider** provides Oracle JDBC with a **database password** that is managed by **HashiCorp Vault Secrets**.
-This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-password`.
-
-In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-Default Value |
-
-
-
-
-secretName |
-The name of the secret in HCP Vault Secrets containing the password. |
-Any valid secret name within the app. |
- No default value. A value must be configured for this parameter. |
-
-
-
-
-An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties).
-
---
### Dedicated Vault TCPS Wallet Provider
@@ -865,55 +589,6 @@ If omitted and multiple keys exist, an error is thrown.
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated-wallet.properties](example-vault-dedicated-wallet.properties).
-### HCP Vault Secrets TCPS Wallet Provider
-
-The **HCP Vault Secrets TCPS Wallet Provide** provides Oracle JDBC with **keys and certificates** managed by **HashiCorp Vault Secrets** to establish secure **TLS connections** with an Autonomous Database.
-This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-tls`.
-
-For example, when connecting to an Autonomous Database Serverless with **mutual TLS (mTLS)**,
-you need to configure the JDBC-thin driver with its client certificate.
-If this certificate is stored in a wallet file (`cwallet.sso`, `ewallet.p12`, `ewallet.pem`),
-you may store it in **HCP Vault Secrets** for additional security.
-This provider retrieves the wallet content from **HCP Vault Secrets** and passes it to the JDBC thin driver.
-
-- The **type** parameter must be specified to indicate the wallet format: **SSO, PKCS12, or PEM**.
-- The **walletPassword** must be provided for wallets that require a password (**PKCS12** or password-protected **PEM** files).
-
-In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-Default Value |
-
-
-
-
-secretName |
-The name of the secret in HCP Vault Secrets containing the wallet. |
-Any valid secret name within the app. |
- No default value. A value must be configured for this parameter. |
-
-
-type |
-The wallet format. |
-SSO , PKCS12 , PEM |
- No default value. The file type must be specified. |
-
-
-walletPassword |
- Optional password for **PKCS12** or protected **PEM** files. If omitted, the file is assumed to be **SSO** or an **unprotected PEM** file. |
-Any valid password. |
- No default value. Required for password-protected files. |
-
-
-
-
-An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets-wallet.properties](example-vault-secrets-wallet.properties).
-
---
### Dedicated Vault SEPS Wallet Provider
@@ -1014,65 +689,6 @@ If omitted and multiple keys exist, an error is thrown.
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated-wallet.properties](example-vault-dedicated-wallet.properties).
-### HCP Vault Secrets SEPS Wallet Provider
-
-The **HCP Vault Secrets SEPS Wallet Provider** provides Oracle JDBC with **username and password credentials** stored in a **Secure External Password Store (SEPS) wallet** within **HCP Vault Secrets**.
-
-This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-seps`.
-
-- The SEPS wallet securely stores **encrypted database credentials**, including the **username, password, and connection strings**.
- These credentials can be stored as **default values**, such as:
- - `oracle.security.client.default_username`
- - `oracle.security.client.default_password`
-
- or as indexed credentials, for example:
- - `oracle.security.client.username1`
- - `oracle.security.client.password1`
- - `oracle.security.client.connect_string1`.
-
-- The provider retrieves credentials using the following logic:
- 1. If `connectionStringIndex` is **not specified**, the provider attempts to retrieve the **default credentials** (`oracle.security.client.default_username` and `oracle.security.client.default_password`).
- 2. If **default credentials are missing**, the provider checks for a single **set of credentials** associated with a **connection string**.
- 3. If **exactly one connection string** is found, the associated credentials are used.
- 4. If **multiple connection strings** exist, an **error is thrown**, prompting you to specify a `connectionStringIndex`.
- 5. If `connectionStringIndex` is specified, the provider attempts to retrieve the credentials associated with the **specified connection string index** (e.g., `oracle.security.client.username{idx}`, `oracle.security.client.password{idx}`, `oracle.security.client.connect_string{idx}`).
- 6. If credentials for the **specified index** are not found, an **error is thrown**, indicating that no connection string exists with that index.
-
-In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also supports the parameters listed below.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-Default Value |
-
-
-
-
-secretName |
-The name of the SEPS wallet secret in HCP Vault Secrets. |
-Any valid secret name within the app. |
-No default value. A value must be configured for this parameter. |
-
-
-walletPassword |
- Optional password for **PKCS12 SEPS wallets**. If omitted, the wallet is assumed to be **SSO**. |
-Any valid password for the SEPS wallet. |
-No default value. PKCS12 wallets require a password. |
-
-
-connectionStringIndex (Optional) |
- Specifies the **index** of the connection string to use when retrieving credentials from the wallet. |
-A positive integer representing the index of the desired credential set (e.g., 1, 2, 3, etc.). |
-No default value. If not specified, the provider follows the default behavior as described above. |
-
-
-
-
-An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets-wallet.properties](example-vault-secrets-wallet.properties).
-
---
### Dedicated Vault Connection String Provider
@@ -1143,46 +759,6 @@ If omitted and multiple keys exist, an error is thrown.
An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-dedicated.properties](example-vault-dedicated.properties).
-### HCP Vault Secrets Connection String Provider
-
-The **HCP Vault Secrets Connection String Provider** provides Oracle JDBC with a **connection string**
-retrieved from a `tnsnames.ora` file stored in **HCP Vault Secrets**.
-
-This is a **Resource Provider** identified by the name `ojdbc-provider-hcpvault-secrets-tnsnames`.
-
-This provider retrieves and decodes a `tnsnames.ora` file stored as a **base64-encoded secret** or **plain text** in **HCP Vault Secrets**, allowing selection of connection strings based on specified aliases.
-
-This enables flexible configuration for **secure database connections** using the alias names defined in your `tnsnames.ora` file.
-
-In addition to the set of [common parameters](#common-parameters-for-hcp-vault-secrets-resource-providers), this provider also requires the parameters listed below.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-Default Value |
-
-
-
-
-secretName |
-The name of the secret in HCP Vault Secrets containing the tnsnames.ora file. |
-Any valid secret name within the app. |
- No default value. A value must be configured for this parameter. |
-
-
-tnsAlias |
-The alias to retrieve the connection string. |
-Any valid alias present in the `tnsnames.ora` file. |
- No default value. A value must be configured for this parameter. |
-
-
-
-
-An example of a [connection properties file](https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE) that configures this provider can be found in [example-vault-secrets.properties](example-vault-secrets.properties).
-
### Common Parameters for HCP Vault Dedicated Resource Providers
Providers classified as Resource Providers in this module all support a common set of parameters.
@@ -1285,73 +861,6 @@ Providers classified as Resource Providers in this module all support a common s
---
-### Common Parameters for HCP Vault Secrets Resource Providers
-
-Providers classified as Resource Providers for HCP Vault Secrets support a common set of parameters used for authenticating with the HCP Vault Secrets API.
-
-
-
-
-Parameter Name |
-Description |
-Accepted Values |
-System Property / Environment Variable |
-Default Value |
-
-
-
-
-authenticationMethod |
-Configures a method of authentication for HCP Vault Secrets. |
-client_credentials , cli_credentials_file , auto-detect |
-Not supported |
-auto-detect |
-
-
-orgId |
-The organization ID associated with the HCP Vault Secrets project. |
-A valid HCP organization ID. |
-HCP_ORG_ID |
-No default value. |
-
-
-projectId |
-The project ID associated with the HCP Vault Secrets app. |
-A valid HCP project ID. |
-HCP_PROJECT_ID |
-No default value. |
-
-
-appName |
-The name of the application registered in HCP Vault Secrets. |
-A valid HCP application name. |
-HCP_APP_NAME |
-No default value. |
-
-
-clientId |
-The client ID used for client credentials OAuth 2.0 authentication. |
-A valid HCP Client ID. |
-HCP_CLIENT_ID |
-No default value. |
-
-
-clientSecret |
-The client secret associated with the client ID. |
-A valid HCP Client Secret. |
-HCP_CLIENT_SECRET |
-No default value. |
-
-
-credentialsFile |
-The path to the local HCP CLI credentials file. |
-A valid file path (e.g., ~/.config/hcp/creds-cache.json ) |
-HCP_CREDENTIALS_FILE |
-~/.config/hcp/creds-cache.json |
-
-
-
-
### Configuring Authentication for Resource Providers
#### HCP Vault Dedicated
@@ -1381,26 +890,7 @@ Supported values for `authenticationMethod`:
3. `approle`
4. `github`
-#### HCP Vault Secrets
-
-Resource Providers that access **HCP Vault Secrets** also require authentication.
-By default, the provider will **auto-detect** the method to use.
-You may override this using the `authenticationMethod` parameter.
-
-Supported values for `authenticationMethod`:
-
-- **`client-credentials`**
- Uses OAuth 2.0 Client Credentials Flow. Requires `clientId` and `clientSecret`.
-
-- **`cli-credentials-file`**
- Uses the local HCP CLI credentials file (`~/.config/hcp/creds-cache.json`), which contains `access_token` and `refresh_token`.
-
-- **`auto-detect`** (default)
- Automatically selects based on:
- 1. `cli-credentials-file` (if file exists or is configured)
- 2. `client-credentials` (if both `clientId` and `clientSecret` are available)
-
-## caching-configuration
+## Caching configuration
Config providers in this module store the configuration in caches to minimize
the number of RPC requests to remote location. See
diff --git a/ojdbc-provider-hashicorp/example-test.properties b/ojdbc-provider-hashicorp/example-test.properties
index 23f03302..df134f3c 100644
--- a/ojdbc-provider-hashicorp/example-test.properties
+++ b/ojdbc-provider-hashicorp/example-test.properties
@@ -152,30 +152,4 @@ SEPS_WALLET_SECRET_PATH=/v1/namespace/secret/data/seps-wallet
SEPS_WALLET_PASSWORD=*****
# Optional index to select specific credentials from the SEPS wallet.
-SEPS_CONNECTION_STRING_INDEX=1
-
-################################################################################
-# HCP VAULT SECRETS CONFIGURATION
-################################################################################
-
-# The name of the application where the secret is stored
-HCP_APP_NAME=your-app-name
-
-# Client ID for OAuth2 client_credentials flow
-HCP_CLIENT_ID=your-client-id
-
-# Client Secret for OAuth2 client_credentials flow
-HCP_CLIENT_SECRET=your-client-secret
-
-# Organization ID in HCP Vault
-HCP_ORG_ID=your-organization-id
-
-# Project ID in HCP Vault
-HCP_PROJECT_ID=your-project-id
-
-# Name of the secret to be fetched from the application
-SECRET_NAME=your-secret-name
-
-# Path to the credentials file containing authentication details
-# (By default: ~/.config/hcp/creds-cache.json if using HCP CLI)
-HCP_CREDENTIALS_FILE=/path/to/your/creds-cache.json
+SEPS_CONNECTION_STRING_INDEX=1
\ No newline at end of file
diff --git a/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties b/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties
deleted file mode 100644
index fb463555..00000000
--- a/ojdbc-provider-hashicorp/example-vault-secrets-wallet.properties
+++ /dev/null
@@ -1,78 +0,0 @@
-################################################################################
-# Copyright (c) 2025 Oracle and/or its affiliates.
-#
-# The Universal Permissive License (UPL), Version 1.0
-#
-# Subject to the condition set forth below, permission is hereby granted to any
-# person obtaining a copy of this software, associated documentation and/or data
-# (collectively the "Software"), free of charge and under any and all copyright
-# rights in the Software, and any and all patent rights owned or freely
-# licensable by each licensor hereunder covering either (i) the unmodified
-# Software as contributed to or provided by such licensor, or (ii) the Larger
-# Works (as defined below), to deal in both
-#
-# (a) the Software, and
-# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
-# one is included with the Software (each a "Larger Work" to which the Software
-# is contributed by such licensors),
-#
-# without restriction, including without limitation the rights to copy, create
-# derivative works of, display, perform, and distribute the Software and make,
-# use, sell, offer for sale, import, export, have made, and have sold the
-# Software and the Larger Work(s), and to sublicense the foregoing rights on
-# either these or other terms.
-#
-# This license is subject to the following condition:
-# The above copyright notice and either this complete permission notice or at
-# a minimum a reference to the UPL must be included in all copies or
-# substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-################################################################################
-
-# An example of a connection properties file that configures Oracle JDBC to
-# obtain a TLS wallet and SEPS credentials from HCP Vault Secrets Service.
-#
-# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file"
-# connection property. For details, see:
-# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE
-
-# Configures the HCP Vault Secrets TCPS (TLS) Wallet Provider. The secret name is
-# configured as an environment variable or JVM system property named "TLS_WALLET_SECRET_NAME".
-oracle.jdbc.provider.tlsConfiguration=ojdbc-provider-hcpvault-secrets-tls
-oracle.jdbc.provider.tlsConfiguration.secretName=${TLS_WALLET_SECRET_NAME}
-
-# Configures the HCP Vault Secrets TLS Wallet Password. The password for the
-# file is optional and can be configured as an environment variable or JVM
-# system property named "TLS_FILE_PASSWORD".
-oracle.jdbc.provider.tlsConfiguration.walletPassword=${TLS_FILE_PASSWORD}
-
-# Specifies the file type (SSO, PKCS12, or PEM) for the TCPS wallet.
-# This can be configured as an environment variable or JVM system property named "TLS_FILE_TYPE".
-oracle.jdbc.provider.tlsConfiguration.type=${TLS_FILE_TYPE}
-
-# Configures the HCP Vault Secrets SEPS (Secure External Password Store) Provider.
-# Secret Name is configured as environment variables or JVM system properties
-# named "SEPS_WALLET_SECRET_NAME".
-oracle.jdbc.provider.username=ojdbc-provider-hcpvault-secrets-seps
-oracle.jdbc.provider.password=ojdbc-provider-hcpvault-secrets-seps
-
-# Configures the Secret Name for SEPS.
-oracle.jdbc.provider.username.secretPath=${SEPS_WALLET_SECRET_NAME}
-oracle.jdbc.provider.password.secretPath=${SEPS_WALLET_SECRET_NAME}
-
-# Optional password for SEPS Wallet stored in HCP Vault Secret.
-oracle.jdbc.provider.username.walletPassword=${SEPS_WALLET_PASSWORD}
-oracle.jdbc.provider.password.walletPassword=${SEPS_WALLET_PASSWORD}
-
-# Optional connection string index for SEPS Wallet.
-# This determines which set of credentials (username/password) to use from the SEPS Wallet.
-oracle.jdbc.provider.username.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX}
-oracle.jdbc.provider.password.connectionStringIndex=${SEPS_CONNECTION_STRING_INDEX}
-
diff --git a/ojdbc-provider-hashicorp/example-vault-secrets.properties b/ojdbc-provider-hashicorp/example-vault-secrets.properties
deleted file mode 100644
index 19e3f957..00000000
--- a/ojdbc-provider-hashicorp/example-vault-secrets.properties
+++ /dev/null
@@ -1,61 +0,0 @@
-################################################################################
-# Copyright (c) 2025 Oracle and/or its affiliates.
-#
-# The Universal Permissive License (UPL), Version 1.0
-#
-# Subject to the condition set forth below, permission is hereby granted to any
-# person obtaining a copy of this software, associated documentation and/or data
-# (collectively the "Software"), free of charge and under any and all copyright
-# rights in the Software, and any and all patent rights owned or freely
-# licensable by each licensor hereunder covering either (i) the unmodified
-# Software as contributed to or provided by such licensor, or (ii) the Larger
-# Works (as defined below), to deal in both
-#
-# (a) the Software, and
-# (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
-# one is included with the Software (each a "Larger Work" to which the Software
-# is contributed by such licensors),
-#
-# without restriction, including without limitation the rights to copy, create
-# derivative works of, display, perform, and distribute the Software and make,
-# use, sell, offer for sale, import, export, have made, and have sold the
-# Software and the Larger Work(s), and to sublicense the foregoing rights on
-# either these or other terms.
-#
-# This license is subject to the following condition:
-# The above copyright notice and either this complete permission notice or at
-# a minimum a reference to the UPL must be included in all copies or
-# substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-################################################################################
-
-# An example of a connection properties file that configures Oracle JDBC to
-# login using a username and password managed by HashiCorp Vault Secrets service.
-# This file can be located by Oracle JDBC using the "oracle.jdbc.config.file"
-# connection property. For details, see:
-# https://docs.oracle.com/en/database/oracle/oracle-database/23/jajdb/oracle/jdbc/OracleConnection.html#CONNECTION_PROPERTY_CONFIG_FILE
-
-# Configures the HCP Vault Secrets Username Provider.The secret name is
-# configured as an environment variable or JVM system property named "USERNAME_SECRET_NAME".
-oracle.jdbc.provider.username=ojdbc-provider-hcpvault-secrets-username
-oracle.jdbc.provider.username.secretName=${USERNAME_SECRET_NAME}
-
-# Configures the HCP Vault Secrets Password Provider.The secret name is
-# configured as an environment variable or JVM system property named "PASSWORD_SECRET_NAME".
-oracle.jdbc.provider.password=ojdbc-provider-hcpvault-secrets-password
-oracle.jdbc.provider.password.secretName=${PASSWORD_SECRET_NAME}
-
-# Configures the HCP Vault Secrets Connection String Provider. The secret name and alias
-# are configured as environment variables or JVM system properties named "TNSNAMES_SECRET_NAME" and "TNS_ALIAS".
-oracle.jdbc.provider.connectionString=ojdbc-provider-hcpvault-secrets-tnsnames
-oracle.jdbc.provider.connectionString.secretName=${TNSNAMES_SECRET_NAME}
-oracle.jdbc.provider.connectionString.tnsAlias=${TNS_ALIAS}
-
-
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java
deleted file mode 100644
index 5e88d5c1..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/HcpVaultResourceFactory.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret;
-
-import oracle.jdbc.provider.factory.Resource;
-import oracle.jdbc.provider.factory.ResourceFactory;
-import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretToken;
-import oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultTokenFactory;
-import oracle.jdbc.provider.parameter.ParameterSet;
-
-public abstract class HcpVaultResourceFactory implements ResourceFactory {
-
- @Override
- public final Resource request(ParameterSet parameterSet) {
- HcpVaultSecretToken credentials = HcpVaultTokenFactory
- .getInstance()
- .request(parameterSet)
- .getContent();
-
- try {
- return request(credentials, parameterSet);
- } catch (Exception e) {
- throw new IllegalStateException(
- "Request failed with parameters: " + parameterSet, e);
- }
- }
-
- public abstract Resource request(
- HcpVaultSecretToken credentials, ParameterSet parameterSet);
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java
deleted file mode 100644
index dc7ad40c..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AbstractHcpVaultAuthentication.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.parameter.ParameterSet;
-
-import java.util.Map;
-
-/**
- * Base class for HCP Vault Secrets authentication strategies.
- *
- * Subclasses must implement methods to generate an access token and a cache key.
- *
- */
-public abstract class AbstractHcpVaultAuthentication {
-
- /**
- * Generates an HCP Vault Secrets token based on the provided parameters.
- *
- * @param parameterSet the parameters for the authentication request.
- * @return the generated {@link HcpVaultSecretToken}.
- */
- public abstract HcpVaultSecretToken generateToken(ParameterSet parameterSet);
-
- /**
- * Generates a cache key for the authentication request.
- *
- * @param parameterSet the parameters for the authentication request.
- * @return a {@link ParameterSet} to be used as a cache key.
- */
- public abstract Map generateCacheKey(ParameterSet parameterSet);
-
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java
deleted file mode 100644
index 3ed5725f..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/AutoDetectAuthentication.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.parameter.ParameterSet;
-
-import java.util.Collections;
-import java.util.Map;
-
-/**
- * Automatically selects the best authentication method based on available parameters.
- *
- * The priority order is:
- *
- * - CLI_CREDENTIALS_FILE
- * - CLIENT_CREDENTIALS
- *
- */
-public class AutoDetectAuthentication extends AbstractHcpVaultAuthentication {
-
- /**
- * Singleton instance of {@link AutoDetectAuthentication}.
- */
- public static final AutoDetectAuthentication INSTANCE = new AutoDetectAuthentication();
-
- /**
- * Ordered list of authentication methods by priority.
- */
- private static final AbstractHcpVaultAuthentication[] AUTHENTICATION_METHODS = {
- CliCredentialsFileAuthentication.INSTANCE,
- ClientCredentialsAuthentication.INSTANCE
- };
-
- private AutoDetectAuthentication() {
- // Private constructor to enforce singleton
- }
-
- @Override
- public HcpVaultSecretToken generateToken(ParameterSet parameterSet) {
- IllegalStateException previousFailure = null;
-
- for (AbstractHcpVaultAuthentication authentication : AUTHENTICATION_METHODS) {
- try {
- return authentication.generateToken(parameterSet);
- } catch (RuntimeException e) {
- IllegalStateException failure = new IllegalStateException(
- "Failed to authenticate using " + authentication.getClass().getSimpleName(), e);
- if (previousFailure == null) {
- previousFailure = failure;
- } else {
- previousFailure.addSuppressed(failure);
- }
- }
- }
-
- throw previousFailure;
- }
-
- @Override
- public Map generateCacheKey(ParameterSet parameterSet) {
- for (AbstractHcpVaultAuthentication authentication : AUTHENTICATION_METHODS) {
- Map cacheKey = authentication.generateCacheKey(parameterSet);
- if (!cacheKey.isEmpty()) {
- return cacheKey;
- }
- }
- return Collections.emptyMap();
- }
-
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java
deleted file mode 100644
index 0716c93a..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/CliCredentialsFileAuthentication.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.parameter.ParameterSet;
-import java.util.Map;
-
-import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*;
-
-/**
- * Handles authentication using a credentials file generated by the HCP CLI.
- */
-public class CliCredentialsFileAuthentication extends AbstractHcpVaultAuthentication {
-
- /**
- * Singleton instance of {@link CliCredentialsFileAuthentication}.
- */
- public static final CliCredentialsFileAuthentication INSTANCE = new CliCredentialsFileAuthentication();
-
- private CliCredentialsFileAuthentication() {
- // Private constructor to enforce singleton
- }
-
- @Override
- public HcpVaultSecretToken generateToken(ParameterSet parameterSet) {
- try {
- String credentialsFile = parameterSet.getRequired(HCP_CREDENTIALS_FILE);
- HcpVaultCredentialsFileAuthenticator fileAuthenticator =
- new HcpVaultCredentialsFileAuthenticator(credentialsFile);
- String token = fileAuthenticator.getValidAccessToken();
- return new HcpVaultSecretToken(token);
- } catch (Exception e) {
- throw new IllegalStateException("Failed to authenticate using HCP CLI credentials file", e);
- }
- }
-
- @Override
- public Map generateCacheKey(ParameterSet parameterSet) {
- return parameterSet.filterParameters(new String[]{PARAM_HCP_CREDENTIALS_FILE});
- }
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java
deleted file mode 100644
index 7bea53e2..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/ClientCredentialsAuthentication.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.parameter.ParameterSet;
-import java.util.Map;
-
-import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.*;
-
-/**
- * Handles authentication using the OAuth2 client_credentials flow for HCP Vault Secrets.
- */
-public class ClientCredentialsAuthentication extends AbstractHcpVaultAuthentication {
-
- /**
- * Singleton instance of {@link ClientCredentialsAuthentication}.
- */
- public static final ClientCredentialsAuthentication INSTANCE = new ClientCredentialsAuthentication();
-
- private ClientCredentialsAuthentication() {
- // Private constructor to enforce singleton
- }
-
- @Override
- public HcpVaultSecretToken generateToken(ParameterSet parameterSet) {
- String clientId = parameterSet.getRequired(HCP_CLIENT_ID);
- String clientSecret = parameterSet.getRequired(HCP_CLIENT_SECRET);
- String rawToken = HcpVaultOAuthClient.fetchHcpAccessToken(clientId, clientSecret);
- return new HcpVaultSecretToken(rawToken);
- }
-
- @Override
- public Map generateCacheKey(ParameterSet parameterSet) {
- return parameterSet.filterParameters(new String[]{
- PARAM_HCP_CLIENT_ID, PARAM_HCP_CLIENT_SECRET
- });
- }
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java
deleted file mode 100644
index cc52ef50..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultAuthenticationMethod.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-/**
- * Enumeration of authentication methods supported by HCP Vault Secrets.
- *
- * This represents the different ways to authenticate with the HCP Vault Secrets API.
- *
- */
-public enum HcpVaultAuthenticationMethod {
-
- /**
- * Authentication using client credentials via the OAuth2 client_credentials flow.
- *
- * This method requires the following:
- *
- *
- * - A Client ID provided by the HCP Vault console or associated
- * with an HCP Service Principal.
- *
- * - A Client Secret corresponding to the Client ID, ensuring
- * secure access.
- *
- *
- *
- * By using these credentials, the method retrieves a short-lived API token
- * by calling the HCP OAuth2 endpoint.
- *
- */
- CLIENT_CREDENTIALS,
-
- /**
- * Authentication using the credentials file generated by the HCP CLI.
- *
- * This method retrieves an access token from the standard CLI-generated
- * credentials file located at
- * System.getProperty("user.home") + "/.config/hcp/creds-cache.json"
.
- * If the token is expired,
- * it will be automatically refreshed using the stored refresh token.
- *
- *
- * The credentials file must follow the standard JSON structure containing:
- *
- *
- * {
- * "login": {
- * "access_token": "...",
- * "refresh_token": "...",
- * "access_token_expiry": "..."
- * }
- * }
- *
- *
- * The user can provide a custom path to the credentials file if needed.
- *
- */
- CLI_CREDENTIALS_FILE,
-
- /**
- * Automatically selects the best authentication method based on available parameters.
- *
- * Priority order:
- *
- * - Uses the credentials file if present and valid.
- * - Falls back to client credentials authentication.
- *
- */
- AUTO_DETECT;
-}
\ No newline at end of file
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java
deleted file mode 100644
index e551925a..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultCredentialsFileAuthenticator.java
+++ /dev/null
@@ -1,246 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.hashicorp.util.HttpUtil;
-import oracle.jdbc.provider.hashicorp.util.JsonUtil;
-import oracle.sql.json.OracleJsonObject;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.time.Instant;
-import java.time.OffsetDateTime;
-import java.time.ZoneOffset;
-import java.time.format.DateTimeFormatter;
-import java.util.Base64;
-import java.util.concurrent.locks.ReentrantLock;
-
-/**
- * Handles authentication using the HashiCorp CLI credentials cache.
- *
- * This class reads the authentication details from the CLI-generated credentials file
- * (`creds-cache.json`) and manages the token lifecycle, including:
- *
- *
- * - Validating the access token's expiration.
- * - Refreshing the token using the stored refresh token when expired.
- * - Updating the credentials file with the new token details.
- *
- *
- * By default, the credentials file is expected at:
- * System.getProperty("user.home") + "/.config/hcp/creds-cache.json"
.
- * However, users can provide a custom file path through configuration.
- *
- */
-public final class HcpVaultCredentialsFileAuthenticator {
- private static final String TOKEN_URL = "https://auth.idp.hashicorp.com/oauth2/token";
- private static final String GRANT_TYPE = "refresh_token";
- private static final String CONTENT_TYPE = "application/x-www-form-urlencoded";
- private static final String TOKEN_REFRESH_PAYLOAD_FORMAT = "grant_type=%s&refresh_token=%s&client_id=%s";
- private static final String CREDENTIALS_JSON_FORMAT =
- "{ \"login\": { \"access_token\": \"%s\", \"refresh_token\": \"%s\", \"access_token_expiry\": \"%s\" } }";
-
- // JSON field constants
- public static final String ACCESS_TOKEN_FIELD = "access_token";
- private static final String REFRESH_TOKEN_FIELD = "refresh_token";
- private static final String ACCESS_TOKEN_EXPIRY_FIELD = "access_token_expiry";
- private static final String EXPIRES_IN_FIELD = "expires_in";
- private static final String CLIENT_ID_FIELD = "client_id";
- private static final String LOGIN_FIELD = "login";
-
- private final ReentrantLock lock = new ReentrantLock();
-
- private volatile String accessToken;
- private volatile String refreshToken;
- private volatile Instant tokenExpiry;
-
- private final Path credsFilePath;
-
- /**
- * Creates an instance of {@link HcpVaultCredentialsFileAuthenticator} to handle authentication
- * via the HCP CLI credentials cache file.
- *
- * @param credentialsFilePath The path to the credentials file.
- */
- public HcpVaultCredentialsFileAuthenticator(String credentialsFilePath) {
- this.credsFilePath = Paths.get(credentialsFilePath);
- }
-
- /**
- * Retrieves a valid access token, refreshing it if expired.
- *
- * @return A valid access token.
- * @throws IOException if authentication fails.
- */
- public String getValidAccessToken() throws Exception {
- lock.lock();
- try {
- if (accessToken == null || isTokenExpired()) {
- loadCredentials();
- if (isTokenExpired()) {
- refreshAccessToken();
- }
- }
- return accessToken;
- } finally {
- lock.unlock();
- }
- }
-
- /**
- * Loads credentials from the CLI cache file.
- *
- * @throws IOException if there is an error reading the file
- */
- private void loadCredentials() throws IOException {
- if (!Files.exists(credsFilePath)) {
- throw new IOException("HCP Vault credentials file not found: " + credsFilePath);
- }
-
- String content = new String(Files.readAllBytes(credsFilePath), StandardCharsets.UTF_8);
-
- OracleJsonObject rootObject = JsonUtil.convertJsonToOracleJsonObject(content);
- if (rootObject == null) {
- throw new IOException("Failed to parse credentials file: invalid JSON format");
- }
-
- OracleJsonObject loginObject;
- try {
- loginObject = rootObject.getObject(LOGIN_FIELD);
- } catch (NullPointerException e) {
- throw new IOException("Invalid credentials file format: missing 'login'" +
- " object", e);
- }
- accessToken = JsonUtil.extractField(loginObject, ACCESS_TOKEN_FIELD);
- refreshToken = JsonUtil.extractField(loginObject, REFRESH_TOKEN_FIELD);
-
- String expiryStr = JsonUtil.extractField(loginObject, ACCESS_TOKEN_EXPIRY_FIELD);
- if (expiryStr != null && !expiryStr.isEmpty()) {
- tokenExpiry = OffsetDateTime.parse(expiryStr, DateTimeFormatter.ISO_OFFSET_DATE_TIME).toInstant();
- }
- }
-
- /**
- * Checks if the current token is expired.
- *
- * @return true if the token is expired
- */
- private boolean isTokenExpired() {
- return tokenExpiry == null || Instant.now().isAfter(tokenExpiry);
- }
-
- /**
- * Refreshes the access token using the refresh token.
- *
- * @throws IOException if the refresh operation fails
- */
- private void refreshAccessToken() throws Exception {
- String clientId = extractClientIdFromToken(accessToken);
- if (clientId == null || refreshToken == null) {
- throw new IllegalStateException("Missing required parameters for token refresh.");
- }
-
- String payload = String.format(TOKEN_REFRESH_PAYLOAD_FORMAT, GRANT_TYPE, refreshToken, clientId);
- String jsonResponse = HttpUtil.sendPostRequest(TOKEN_URL, payload, CONTENT_TYPE, null
- , null);
-
- OracleJsonObject response = JsonUtil.convertJsonToOracleJsonObject(jsonResponse);
- updateTokensFromResponse(response);
- updateCredsFile();
- }
-
- /**
- * Updates tokens and expiry from the refresh response.
- *
- * @param response The JSON response from the refresh request
- */
- private void updateTokensFromResponse(OracleJsonObject response) {
- accessToken = JsonUtil.extractField(response, ACCESS_TOKEN_FIELD);
-
- try {
- long expiresInSeconds = response.getLong(EXPIRES_IN_FIELD);
- tokenExpiry = Instant.now().plusSeconds(expiresInSeconds);
- } catch (NullPointerException e) {
- throw new IllegalStateException("Missing '" + EXPIRES_IN_FIELD + "' field in token response", e);
- }
-
- // Update refresh token if provided
- String newRefreshToken = JsonUtil.extractField(response, REFRESH_TOKEN_FIELD);
- if (newRefreshToken != null && !newRefreshToken.isEmpty()) {
- refreshToken = newRefreshToken;
- }
- }
-
- /**
- * Updates the credentials cache file with new token information.
- *
- * @throws IOException if file writing fails
- */
- private void updateCredsFile() throws IOException {
- String updatedContent = String.format(CREDENTIALS_JSON_FORMAT, accessToken,
- refreshToken, OffsetDateTime.ofInstant(tokenExpiry, ZoneOffset.UTC).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME)
- );
-
- Files.write(credsFilePath, updatedContent.getBytes(StandardCharsets.UTF_8));
- }
-
- /**
- * Extracts the client ID from a JWT token.
- *
- * @param token The JWT token
- * @return The extracted client ID
- * @throws IllegalArgumentException if the token is invalid or client_id extraction fails.
- */
- private static String extractClientIdFromToken(String token) {
- try {
- String[] parts = token.split("\\.");
- if (parts.length != 3) {
- throw new IllegalArgumentException("Invalid JWT token format.");
- }
- String payloadJson = new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8);
- OracleJsonObject payload = JsonUtil.convertJsonToOracleJsonObject(payloadJson);
- return JsonUtil.extractField(payload, CLIENT_ID_FIELD);
- } catch (Exception e) {
- throw new IllegalArgumentException("Failed to extract client_id from JWT token.", e);
- }
- }
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java
deleted file mode 100644
index 7b1773c3..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultOAuthClient.java
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.hashicorp.util.HttpUtil;
-import oracle.jdbc.provider.hashicorp.util.JsonUtil;
-import oracle.sql.json.OracleJsonObject;
-
-import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultCredentialsFileAuthenticator.ACCESS_TOKEN_FIELD;
-
-/**
- * A client for performing OAuth2 operations with HCP Vault Secrets.
- *
- * This class implements the client_credentials flow to obtain an API token
- * required for interacting with HCP Vault Secrets.
- *
- */
-public final class HcpVaultOAuthClient {
-
- private static final String OAUTH_TOKEN_URL = "https://auth.idp.hashicorp.com/oauth/token";
- private static final String CONTENT_TYPE = "application/x-www-form-urlencoded";
- private static final String GRANT_TYPE = "client_credentials";
- private static final String AUDIENCE = "https://api.hashicorp.cloud";
- private static final String CLIENT_CREDENTIALS_PAYLOAD_FORMAT =
- "grant_type=%s&client_id=%s&client_secret=%s&audience=%s";
-
- private HcpVaultOAuthClient() {}
-
- /**
- * Fetches an access token from HCP Vault Secrets using the client_credentials flow.
- *
- * @param clientId the OAuth2 client ID. Must not be null or empty.
- * @param clientSecret the OAuth2 client secret. Must not be null or empty.
- * @return the access token as a {@code String}. Never null or empty.
- * @throws IllegalStateException if the token cannot be obtained.
- */
- public static String fetchHcpAccessToken(String clientId, String clientSecret) {
- try {
- String payload = String.format(
- CLIENT_CREDENTIALS_PAYLOAD_FORMAT, GRANT_TYPE, clientId, clientSecret, AUDIENCE);
-
- String jsonResponse = HttpUtil.sendPostRequest(
- OAUTH_TOKEN_URL,
- payload,
- CONTENT_TYPE,
- null,
- null
- );
- OracleJsonObject response = JsonUtil.convertJsonToOracleJsonObject(jsonResponse);
- return JsonUtil.extractField(response, ACCESS_TOKEN_FIELD);
-
- } catch (Exception e) {
- throw new IllegalStateException("Failed to fetch HCP access token", e);
- }
- }
-
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java
deleted file mode 100644
index 1f70a637..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretParameters.java
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.provider.hashicorp.util.Parameterutil;
-import oracle.jdbc.provider.parameter.Parameter;
-import oracle.jdbc.provider.parameter.ParameterSet;
-import oracle.jdbc.provider.parameter.ParameterSetParser;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultAuthenticationMethod.AUTO_DETECT;
-import static oracle.jdbc.provider.parameter.Parameter.CommonAttribute.*;
-
-/**
- * Contains parameter definitions for interacting with HCP Vault Secrets.
- *
- * This class centralizes configuration parameters used for authenticating
- * with and retrieving secrets from HCP Vault Secrets.
- *
- */
-public class HcpVaultSecretParameters {
-
- /**
- * Constants representing the configuration parameter names for HCP Vault Secrets.
- *
- * These constants serve as both parameter names within the {@link ParameterSet}
- * and as keys for environment variables or system properties.
- *
- */
- public static final String PARAM_HCP_ORG_ID = "HCP_ORG_ID";
- public static final String PARAM_HCP_PROJECT_ID = "HCP_PROJECT_ID";
- public static final String PARAM_HCP_APP_NAME = "HCP_APP_NAME";
- public static final String PARAM_HCP_CLIENT_ID = "HCP_CLIENT_ID";
- public static final String PARAM_HCP_CLIENT_SECRET = "HCP_CLIENT_SECRET";
- public static final String PARAM_HCP_CREDENTIALS_FILE =
- "HCP_CREDENTIALS_FILE";
- public static final String DEFAULT_CREDENTIALS_FILE_PATH =
- System.getProperty("user.home") + "/.config/hcp/creds-cache.json";
- private static final String PARAM_AUTHENTICATION = "AUTHENTICATION";
-
- /**
- * Parameter indicating the authentication method to use for HCP Vault Secrets.
- */
- public static final Parameter AUTHENTICATION_METHOD = Parameter.create(REQUIRED);
-
- /**
- * Parameter for the OAuth2 client ID. Required.
- */
- public static final Parameter HCP_CLIENT_ID = Parameter.create();
-
- /**
- * Parameter for the OAuth2 client secret. Required.
- */
- public static final Parameter HCP_CLIENT_SECRET = Parameter.create();
-
- /**
- * Parameter for the credentials file path.
- * By default, the credentials file is expected at:
- * System.getProperty("user.home") + "/.config/hcp/creds-cache.json"
.
- */
- public static final Parameter HCP_CREDENTIALS_FILE = Parameter.create();
-
- /**
- * Parameter for the organization ID. Required.
- */
- public static final Parameter HCP_ORG_ID = Parameter.create();
-
- /**
- * Parameter for the project ID. Required.
- */
- public static final Parameter HCP_PROJECT_ID = Parameter.create();
-
- /**
- * Parameter for the application name. Required.
- */
- public static final Parameter HCP_APP_NAME = Parameter.create();
-
- /**
- * Parameter for the secret name. Required.
- */
- public static final Parameter SECRET_NAME = Parameter.create(REQUIRED);
-
- /**
- * Parameter for the optional key in the secret JSON.
- */
- public static final Parameter KEY = Parameter.create();
-
- /**
- * Builds a ParameterSet from the given options map.
- *
- * This method makes a defensive copy of the provided map, ensures that a default
- * authentication method is set, and then fills in missing keys using fallback values
- * (from system properties or environment variables) based on the authentication method.
- * Finally, it parses the updated map into a ParameterSet.
- *
- *
- * @param inputOpts The input options map.
- * @return The ParameterSet.
- */
- public static ParameterSet buildResolvedParameterSet(Map inputOpts) {
- Map opts = new HashMap<>(inputOpts);
-
- String authStr = opts.entrySet().stream()
- .filter(entry -> entry.getKey().equalsIgnoreCase(PARAM_AUTHENTICATION))
- .map(Map.Entry::getValue)
- .findFirst()
- .orElse(HcpVaultAuthenticationMethod.AUTO_DETECT.name());
-
- HcpVaultAuthenticationMethod authMethod =
- HcpVaultAuthenticationMethod.valueOf(authStr.toUpperCase());
-
- opts.computeIfAbsent(PARAM_HCP_ORG_ID, Parameterutil::getFallback);
- opts.computeIfAbsent(PARAM_HCP_PROJECT_ID, Parameterutil::getFallback);
- opts.computeIfAbsent(PARAM_HCP_APP_NAME, Parameterutil::getFallback);
-
- switch (authMethod) {
- case CLIENT_CREDENTIALS:
- opts.computeIfAbsent(PARAM_HCP_CLIENT_ID, Parameterutil::getFallback);
- opts.computeIfAbsent(PARAM_HCP_CLIENT_SECRET, Parameterutil::getFallback);
- break;
- case CLI_CREDENTIALS_FILE:
- opts.computeIfAbsent(PARAM_HCP_CREDENTIALS_FILE, Parameterutil::getFallback);
- break;
- case AUTO_DETECT:
- opts.computeIfAbsent(PARAM_HCP_CLIENT_ID, Parameterutil::getFallback);
- opts.computeIfAbsent(PARAM_HCP_CLIENT_SECRET, Parameterutil::getFallback);
- opts.computeIfAbsent(PARAM_HCP_CREDENTIALS_FILE, Parameterutil::getFallback);
- break;
- default:
- break;
- }
- return PARAMETER_SET_PARSER.parseNamedValues(opts);
- }
-
- /**
- * Parses the authentication method from a string value.
- *
- * @param value the string value representing the authentication method. Must
- * not be null.
- * @return the parsed {@link HcpVaultAuthenticationMethod}.
- * @throws IllegalArgumentException if the value is unrecognized.
- */
- private static HcpVaultAuthenticationMethod parseAuthMethod(String value) {
- try {
- return HcpVaultAuthenticationMethod.valueOf(value.toUpperCase());
- } catch (IllegalArgumentException e) {
- throw new IllegalArgumentException(
- "Unrecognized HCP auth method: " + value, e);
- }
- }
-
- public static final ParameterSetParser PARAMETER_SET_PARSER =
- ParameterSetParser.builder()
- .addParameter("value", SECRET_NAME)
- .addParameter(PARAM_AUTHENTICATION, AUTHENTICATION_METHOD, AUTO_DETECT,
- HcpVaultSecretParameters::parseAuthMethod)
- .addParameter(PARAM_HCP_ORG_ID, HCP_ORG_ID)
- .addParameter(PARAM_HCP_PROJECT_ID, HCP_PROJECT_ID)
- .addParameter(PARAM_HCP_APP_NAME, HCP_APP_NAME)
- .addParameter(PARAM_HCP_CLIENT_ID, HCP_CLIENT_ID)
- .addParameter(PARAM_HCP_CLIENT_SECRET, HCP_CLIENT_SECRET)
- .addParameter(PARAM_HCP_CREDENTIALS_FILE, HCP_CREDENTIALS_FILE, DEFAULT_CREDENTIALS_FILE_PATH)
- .addParameter("KEY", KEY)
- .addParameter("type", Parameter.create())
- .build();
-
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java
deleted file mode 100644
index 14a2d677..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultSecretToken.java
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-/**
- * Represents the credentials required to authenticate with HCP Vault Secrets.
- *
- * This class holds the API token obtained from the client_credentials OAuth2 flow.
- *
- */
-public final class HcpVaultSecretToken {
- private final String hcpApiToken;
-
- /**
- * Constructs a new {@code HcpVaultSecretToken} object with
- * the provided API token.
- *
- * @param hcpApiToken the token used to authenticate API requests to
- * the HCP Vault Secret. Must not be null or empty.
- * @throws IllegalArgumentException if {@code hcpApiToken} is null or empty.
- */
- public HcpVaultSecretToken(String hcpApiToken) {
- if (hcpApiToken == null || hcpApiToken.isEmpty()) {
- throw new IllegalArgumentException("HCP API token must not be null or empty.");
- }
- this.hcpApiToken = hcpApiToken;
- }
-
- /**
- * Returns the HCP API token used for authentication.
- *
- * @return the HCP API token as a {@link String}.
- */
- public String getHcpApiToken() {
- return hcpApiToken;
- }
-}
diff --git a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java b/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java
deleted file mode 100644
index 05bfdfb1..00000000
--- a/ojdbc-provider-hashicorp/src/main/java/oracle/jdbc/provider/hashicorp/hcpvaultsecret/authentication/HcpVaultTokenFactory.java
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- ** Copyright (c) 2025 Oracle and/or its affiliates.
- **
- ** The Universal Permissive License (UPL), Version 1.0
- **
- ** Subject to the condition set forth below, permission is hereby granted to any
- ** person obtaining a copy of this software, associated documentation and/or data
- ** (collectively the "Software"), free of charge and under any and all copyright
- ** rights in the Software, and any and all patent rights owned or freely
- ** licensable by each licensor hereunder covering either (i) the unmodified
- ** Software as contributed to or provided by such licensor, or (ii) the Larger
- ** Works (as defined below), to deal in both
- **
- ** (a) the Software, and
- ** (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
- ** one is included with the Software (each a "Larger Work" to which the Software
- ** is contributed by such licensors),
- **
- ** without restriction, including without limitation the rights to copy, create
- ** derivative works of, display, perform, and distribute the Software and make,
- ** use, sell, offer for sale, import, export, have made, and have sold the
- ** Software and the Larger Work(s), and to sublicense the foregoing rights on
- ** either these or other terms.
- **
- ** This license is subject to the following condition:
- ** The above copyright notice and either this complete permission notice or at
- ** a minimum a reference to the UPL must be included in all copies or
- ** substantial portions of the Software.
- **
- ** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- ** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- ** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- ** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- ** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- ** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- ** SOFTWARE.
- */
-
-package oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication;
-
-import oracle.jdbc.AccessToken;
-import oracle.jdbc.driver.oauth.JsonWebToken;
-import oracle.jdbc.provider.factory.Resource;
-import oracle.jdbc.provider.factory.ResourceFactory;
-import oracle.jdbc.provider.parameter.Parameter;
-import oracle.jdbc.provider.parameter.ParameterSet;
-
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.function.Supplier;
-
-import static oracle.jdbc.provider.hashicorp.hcpvaultsecret.authentication.HcpVaultSecretParameters.AUTHENTICATION_METHOD;
-import static oracle.jdbc.provider.parameter.Parameter.CommonAttribute.REQUIRED;
-/**
- * A factory for creating {@link HcpVaultSecretToken} objects for HCP Vault Secrets.
- *
- * Implements the client_credentials flow as well as file-based authentication.
- * The auto-detect mode attempts file-based authentication first, then falls back
- * to client credentials.
- *
- */
-public final class HcpVaultTokenFactory implements ResourceFactory {
-
- private static final HcpVaultTokenFactory INSTANCE = new HcpVaultTokenFactory();
-
- private static final ConcurrentHashMap