chore: migrate code from googleapis/java-security-private-ca

privateca/snippets/README.md

@@ -0,0 +1,75 @@
+# Google Cloud Private Certificate Authority Service
+
+<a href="https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/java-docs-samples&page=editor&open_in_editor=privateca/snippets/README.md">
+<img alt="Open in Cloud Shell" src ="http://gstatic.com/cloudssh/images/open-btn.png"></a>
+
+Google [Cloud Private Certificate Authority Service](https://cloud.google.com/certificate-authority-service) is a highly available, scalable Google Cloud service that enables you to simplify, automate, and customize the deployment, management, and security of private certificate authorities (CA).
+
+These sample Java applications demonstrate how to access the Cloud CA API using the
+Google Java API Client Libraries.
+
+## Prerequisites
+
+### Google Cloud Project
+
+Set up a Google Cloud project with billing enabled.
+
+### Enable the API
+
+You must [enable the Google Private Certificate Authority Service API](https://console.cloud.google.com/flows/enableapi?apiid=privateca.googleapis.com) for your project in order to use these samples.
+
+### Service account
+
+A service account with private key credentials is required to create signed bearer tokens.
+Create a [service account](https://console.cloud.google.com/iam-admin/serviceaccounts/create) and download the credentials file as JSON.
+
+### Set Environment Variables
+
+You must set your project ID and service account credentials in order to run the tests.
+
+```
+$ export GOOGLE_CLOUD_PROJECT="<google-project-id-here>"
+$ export GOOGLE_APPLICATION_CREDENTIALS="<path-to-service-account-credentials-file>"
+```
+
+### Grant Permissions
+
+You must ensure that the [user account or service account](https://cloud.google.com/iam/docs/service-accounts#differences_between_a_service_account_and_a_user_account) you used to authorize your gcloud session has the proper permissions to edit Private CA resources for your project. In the Cloud Console under IAM, add the following roles to the project whose service account you're using to test:
+
+* Cloud CA Service Admin
+* Cloud CA Service Certificate Requester
+* Cloud CA Service Certificate Manager  
+* Cloud CA Service Certificate Template User
+* Cloud CA Service Workload Certificate Requester  
+* Cloud CA Service Operation Manager  
+* Cloud CA Service Auditor
+
+More information can be found in the [Google Private Certificate Authority Service Docs](https://cloud.google.com/certificate-authority-service/docs/reference/permissions-and-roles).
+
+
+## Build and Run
+
+The following instructions will help you prepare your development environment.
+
+1. Download and install the [Java Development Kit (JDK)](https://www.oracle.com/java/technologies/javase-downloads.html). 
+   Verify that the [JAVA_HOME](https://docs.oracle.com/javase/8/docs/technotes/guides/troubleshoot/envvars001.html) environment variable is set and points to your JDK installation.
+
+
+2. Download and install [Apache Maven](http://maven.apache.org/download.cgi) by following the [Maven installation guide](http://maven.apache.org/install.html) for your specific operating system.
+
+
+3. Clone the GoogleCloudPlatform/java-docs-samples repository.
+```
+git clone https://github.com/GoogleCloudPlatform/java-docs-samples.git
+```
+
+4. Navigate to the sample code directory.
+
+```
+cd privateca/snippets
+```
+
+5. Run the **SnippetsIT** test file present under the test folder.
+
+### Crypto frameworks 
+[Bouncy Castle](https://www.bouncycastle.org/documentation.html) cryptographic framework is used as a part of testing.

privateca/snippets/pom.xml

@@ -0,0 +1,84 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!--
+  Copyright 2021 Google LLC
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+  http://www.apache.org/licenses/LICENSE-2.0
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.cloud</groupId>
+  <artifactId>security-private-ca-snippets</artifactId>
+  <packaging>jar</packaging>
+  <name>Google Certificate Authority Service Snippets</name>
+  <url>https://github.com/googleapis/java-security-private-ca</url>
+
+  <!--
+    The parent pom defines common style checks and testing strategies for our samples.
+    Removing or replacing it should not affect the execution of the samples in anyway.
+  -->
+  <parent>
+    <groupId>com.google.cloud.samples</groupId>
+    <artifactId>shared-configuration</artifactId>
+    <version>1.2.0</version>
+  </parent>
+
+  <properties>
+    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>com.google.cloud</groupId>
+        <artifactId>libraries-bom</artifactId>
+        <version>26.1.3</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+  <dependencies>
+    <!-- TODO: switch to libraries-bom after this artifact is included -->
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-security-private-ca</artifactId>
+      <version>2.5.4</version>
+    </dependency>
+    <dependency>
+      <groupId>org.bouncycastle</groupId>
+      <artifactId>bcpkix-jdk15on</artifactId>
+      <version>1.70</version>
+    </dependency>
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-kms</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-monitoring</artifactId>
+    </dependency>
+
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.1.3</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+</project>

privateca/snippets/src/main/java/privateca/ActivateSubordinateCa.java

@@ -0,0 +1,133 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package privateca;
+
+// [START privateca_activate_subordinateca]
+
+import com.google.api.core.ApiFuture;
+import com.google.cloud.security.privateca.v1.ActivateCertificateAuthorityRequest;
+import com.google.cloud.security.privateca.v1.CertificateAuthorityName;
+import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
+import com.google.cloud.security.privateca.v1.SubordinateConfig;
+import com.google.longrunning.Operation;
+import java.io.IOException;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+
+public class ActivateSubordinateCa {
+
+  public static void main(String[] args)
+      throws InterruptedException, ExecutionException, IOException {
+    // TODO(developer): Replace these variables before running the sample.
+
+    // location: For a list of locations, see:
+    // https://cloud.google.com/certificate-authority-service/docs/locations
+    // pool_Id: Set a unique id for the CA pool.
+    // subordinateCaName: The CA to be activated.
+    // pemCACertificate: The signed certificate, obtained by signing the CSR.
+    String project = "your-project-id";
+    String location = "ca-location";
+    String pool_Id = "ca-pool-id";
+    String subordinateCaName = "subordinate-certificate-authority-name";
+    String pemCACertificate =
+        "-----BEGIN CERTIFICATE-----\n" + "sample-pem-certificate\n" + "-----END CERTIFICATE-----";
+
+    // certificateAuthorityName: The name of the certificate authority which signed the CSR.
+    // If an external CA (CA not present in Google Cloud) was used for signing,
+    // then use the CA's issuerCertificateChain.
+    String certificateAuthorityName = "certificate-authority-name";
+
+    activateSubordinateCA(
+        project, location, pool_Id, certificateAuthorityName, subordinateCaName, pemCACertificate);
+  }
+
+  // Activate a subordinate CA.
+  // *Prerequisite*: Get the CSR of the subordinate CA signed by another CA. Pass in the signed
+  // certificate and (issuer CA's name or the issuer CA's Certificate chain).
+  // *Post*: After activating the subordinate CA, it should be enabled before issuing certificates.
+  public static void activateSubordinateCA(
+      String project,
+      String location,
+      String pool_Id,
+      String certificateAuthorityName,
+      String subordinateCaName,
+      String pemCACertificate)
+      throws ExecutionException, InterruptedException, IOException {
+    // Initialize client that will be used to send requests. This client only needs to be created
+    // once, and can be reused for multiple requests. After completing all of your requests, call
+    // the `certificateAuthorityServiceClient.close()` method on the client to safely
+    // clean up any remaining background resources.
+    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
+        CertificateAuthorityServiceClient.create()) {
+      // Subordinate CA parent.
+      String subordinateCaParent =
+          CertificateAuthorityName.of(project, location, pool_Id, subordinateCaName).toString();
+
+      // Construct the "Activate CA Request".
+      ActivateCertificateAuthorityRequest activateCertificateAuthorityRequest =
+          ActivateCertificateAuthorityRequest.newBuilder()
+              .setName(subordinateCaParent)
+              // The signed certificate.
+              .setPemCaCertificate(pemCACertificate)
+              .setSubordinateConfig(
+                  SubordinateConfig.newBuilder()
+                      // Follow one of the below methods:
+
+                      // Method 1: If issuer CA is in Google Cloud, set the Certificate Authority
+                      // Name.
+                      .setCertificateAuthority(
+                          CertificateAuthorityName.of(
+                                  project, location, pool_Id, certificateAuthorityName)
+                              .toString())
+
+                      // Method 2: If issuer CA is external to Google Cloud, set the issuer's
+                      // certificate chain.
+                      // The certificate chain of the CA (which signed the CSR) from leaf to root.
+                      // .setPemIssuerChain(
+                      //     SubordinateConfigChain.newBuilder()
+                      //         .addAllPemCertificates(issuerCertificateChain)
+                      //         .build())
+
+                      .build())
+              .build();
+
+      // Activate the CA.
+      ApiFuture<Operation> futureCall =
+          certificateAuthorityServiceClient
+              .activateCertificateAuthorityCallable()
+              .futureCall(activateCertificateAuthorityRequest);
+
+      Operation response = futureCall.get();
+
+      if (response.hasError()) {
+        System.out.println("Error while activating the subordinate CA! " + response.getError());
+        return;
+      }
+
+      System.out.println(
+          "Subordinate Certificate Authority activated successfully ! !" + subordinateCaName);
+      TimeUnit.SECONDS.sleep(3);
+      // The current state will be STAGED.
+      // The Subordinate CA has to be ENABLED before issuing certificates.
+      System.out.println(
+          "Current State: "
+              + certificateAuthorityServiceClient
+                  .getCertificateAuthority(subordinateCaParent)
+                  .getState());
+    }
+  }
+}
+// [END privateca_activate_subordinateca]

privateca/snippets/src/main/java/privateca/CreateCaPool.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package privateca;
+
+// [START privateca_create_ca_pool]
+
+import com.google.api.core.ApiFuture;
+import com.google.cloud.security.privateca.v1.CaPool;
+import com.google.cloud.security.privateca.v1.CaPool.Tier;
+import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
+import com.google.cloud.security.privateca.v1.CreateCaPoolRequest;
+import com.google.cloud.security.privateca.v1.LocationName;
+import com.google.longrunning.Operation;
+import java.io.IOException;
+import java.util.concurrent.ExecutionException;
+
+public class CreateCaPool {
+
+  public static void main(String[] args)
+      throws InterruptedException, ExecutionException, IOException {
+    // TODO(developer): Replace these variables before running the sample.
+    // location: For a list of locations, see:
+    // https://cloud.google.com/certificate-authority-service/docs/locations
+    // pool_Id: Set a unique pool_Id for the CA pool.
+    String project = "your-project-id";
+    String location = "ca-location";
+    String pool_Id = "ca-pool-id";
+    createCaPool(project, location, pool_Id);
+  }
+
+  // Create a Certificate Authority Pool. All certificates created under this CA pool will
+  // follow the same issuance policy, IAM policies,etc.,
+  public static void createCaPool(String project, String location, String pool_Id)
+      throws InterruptedException, ExecutionException, IOException {
+    // Initialize client that will be used to send requests. This client only needs to be created
+    // once, and can be reused for multiple requests. After completing all of your requests, call
+    // the `certificateAuthorityServiceClient.close()` method on the client to safely
+    // clean up any remaining background resources.
+    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
+        CertificateAuthorityServiceClient.create()) {
+
+      /* Create the pool request
+        Set Parent which denotes the project id and location.
+        Set the Tier (see: https://cloud.google.com/certificate-authority-service/docs/tiers).
+      */
+      CreateCaPoolRequest caPoolRequest =
+          CreateCaPoolRequest.newBuilder()
+              .setParent(LocationName.of(project, location).toString())
+              .setCaPoolId(pool_Id)
+              .setCaPool(CaPool.newBuilder().setTier(Tier.ENTERPRISE).build())
+              .build();
+
+      // Create the CA pool.
+      ApiFuture<Operation> futureCall =
+          certificateAuthorityServiceClient.createCaPoolCallable().futureCall(caPoolRequest);
+      Operation response = futureCall.get();
+
+      if (response.hasError()) {
+        System.out.println("Error while creating CA pool !" + response.getError());
+        return;
+      }
+
+      System.out.println("CA pool created successfully: " + pool_Id);
+    }
+  }
+}
+// [END privateca_create_ca_pool]