1. Spring Boot Configuration

When using the Spring CredHub starter dependency, Spring CredHub can be configured with Spring Boot application properties. With the proper configuration properties, Spring CredHub will auto-configure a connection to a CredHub server.

1.1. Mutual TLS Authentication

An application running on Cloud Foundry can authenticate to a CredHub server deployed to the same platform using mutual TLS. Mutual TLS is the default authentication scheme when no other authentication credentials are provided. To use mutual TLS authentication to a CredHub server, simply provide the URL of the CredHub server as an application property:

Unresolved directive in boot-configuration.adoc - include::{examples-dir}config-minimal.yml[]

See the {credhub-api-home}version/2.0/#mutual-tls[CredHub documentation] for more information on mutual TLS authentication.

An application running on Cloud Foundry can use the internal address https://credhub.service.cf.internal:8844 to communicate with a CredHub server deployed to the same platform.

1.2. OAuth2 Authentication

OAuth2 can be used to authenticate via UAA to any CredHub server. Spring CredHub supports client credentials grant tokens for authentication using the following Spring CredHub and Spring Security configuration:

Unresolved directive in boot-configuration.adoc - include::{examples-dir}config-oauth2.yml[]

The ID provided in spring.credhub.oauth2.registration-id must refer to a client configured under spring.security.oauth2.client.registration. See the Spring Boot documentation for more information on Spring Boot OAuth2 client configuration.

The OAuth2 client specified in the Spring Security client registration must have CredHub scopes such as credhub.read or credhub.write to perform most operations. See the {credhub-api-home}version/2.0/#uaa-oauth2[CredHub documentation] for more information on OAuth2 authentication with UAA.