Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
/*
* Copyright (c) 2008 - 2013 10gen, Inc. <http://10gen.com>
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
import com.mongodb.AutoEncryptionSettings;
import com.mongodb.ConnectionString;
import com.mongodb.KeyVaultEncryptionSettings;
import com.mongodb.MongoClientSettings;
import com.mongodb.client.MongoClients;
import com.mongodb.client.model.vault.DataKeyOptions;
import com.mongodb.client.vault.KeyVaults;
import org.bson.BsonDocument;
import org.bson.Document;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.Map;
public class ClientSideEncryptionTest {
public static void main(String[] args) {
// Random 64 bytes for local master key
var localMasterKey = new byte[96];
new SecureRandom().nextBytes(localMasterKey);
var kmsProviders = Map.of("local",
Map.<String, Object>of("key", localMasterKey));
var keyVaultNamespace = "admin.datakeys";
var dbName = "test";
var collName = "coll";
var keyVaultSettings = KeyVaultEncryptionSettings.builder()
.keyVaultMongoClientSettings(MongoClientSettings.builder()
.applyConnectionString(new ConnectionString("mongodb://localhost"))
.build())
.keyVaultNamespace(keyVaultNamespace)
.kmsProviders(kmsProviders)
.build();
var keyVault = KeyVaults.create(keyVaultSettings);
// Might need data key options, but maybe not for "local"
var dataKeyId = keyVault.createDataKey("local", new DataKeyOptions());
var base64DataKeyId = Base64.getEncoder().encodeToString(dataKeyId.getData());
var autoEncryptionSettings =
AutoEncryptionSettings.builder()
.keyVaultNamespace(keyVaultNamespace)
.kmsProviders(kmsProviders)
.namespaceToLocalSchemaDocumentMap(
Map.of(dbName + "." + collName,
// Need a schema that references the new data key
BsonDocument.parse("{" +
" \"properties\": {" +
" \"encryptedField\": {" +
" \"encrypt\": {" +
" \"keyId\": [" +
" {" +
" \"$binary\": {" +
" \"base64\": \"" + base64DataKeyId + "\"," +
" \"subType\": \"04\"" +
" }" +
" }" +
" ]," +
" \"bsonType\": \"string\"," +
" \"algorithm\": \"AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic\"" +
" }" +
" }" +
" }," +
" \"bsonType\": \"object\"" +
" }"))
)
.build();
var clientSettings = MongoClientSettings.builder()
.autoEncryptionSettings(autoEncryptionSettings)
.build();
var client = MongoClients.create(clientSettings);
var collection = client.getDatabase(dbName).getCollection(collName);
collection.drop();
collection.insertOne(new Document("encryptedField", "123456789"));
System.out.println(collection.find().first().toJson());
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.