KeyVault JCA: lazy-load certificate material and add alias regex filtering

sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md

@@ -3,6 +3,8 @@
 ## 2.12.0-beta.1 (Unreleased)
 
 ### Features Added
+- Added lazy loading for Key Vault certificate details in the JCA keystore. Certificate details are now loaded by alias when requested, avoiding unnecessary reads for unconfigured certificates. ([#49774](https://github.com/Azure/azure-sdk-for-java/pull/49774))
+- Added support for `azure.keyvault.jca.certificate-alias-filter-patterns` to filter Key Vault certificate aliases with include/exclude regex patterns. Include patterns are configured directly and exclude patterns are prefixed with `!`. If the property is not configured, alias filtering is disabled and all discovered Key Vault aliases remain eligible for lazy loading. ([#39487](https://github.com/Azure/azure-sdk-for-java/issues/39487))
 
 ### Breaking Changes
 

sdk/keyvault/azure-security-keyvault-jca/README.md

@@ -141,6 +141,7 @@ The JCA library supports configuring the following options:
 * `azure.keyvault.jca.refresh-certificates-when-have-un-trust-certificate`: Indicates whether to refresh certificates when have untrusted certificate.
 * `azure.keyvault.jca.certificates-refresh-interval`: The refresh interval time.
 * `azure.keyvault.jca.certificates-refresh-interval-in-ms`: The refresh interval time.
+* `azure.keyvault.jca.certificate-alias-filter-patterns`: Comma-separated Key Vault alias regex filters. Use include regexes directly and exclude regexes with a `!` prefix. Regex patterns use full-alias matching (`Pattern.matcher(alias).matches()`). An alias is loaded only if it matches at least one include regex (or if no include regex is configured) and matches no exclude regex. Example: `^prod-.*,!^prod-deprecated$,!.*-old$`. If this property is not configured, all discovered Key Vault aliases are eligible for lazy loading.
 * `azure.keyvault.disable-challenge-resource-verification`: Indicates whether to disable verification that the authentication challenge resource matches the Key Vault or Managed HSM domain.
 
 You can configure these properties using:

sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml

@@ -13,12 +13,14 @@
   <suppress files="com.azure.security.keyvault.jca.implementation.KeyVaultClient.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.ClasspathCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.JreCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
+  <suppress files="com.azure.security.keyvault.jca.implementation.certificates.KeyVaultCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.certificates.SpecificPathCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.HttpUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.JsonConverterUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.GoodLoggingCheck" />
   <suppress files="com.azure.security.keyvault.jca.KeyVaultTrustManager.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.KeyVaultClient.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
+  <suppress files="com.azure.security.keyvault.jca.implementation.certificates.KeyVaultCertificates.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.signature.AbstractKeyVaultKeylessSignature.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.signature.KeyVaultKeylessRsaSsaPssSignature.java" checks="io.clientcore.linting.extensions.checkstyle.checks.ThrowFromClientLoggerCheck" />
   <suppress files="com.azure.security.keyvault.jca.implementation.utils.HttpUtil.java" checks="io.clientcore.linting.extensions.checkstyle.checks.UseCaughtExceptionCauseCheck" />

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java

@@ -29,7 +29,9 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 import java.util.logging.Logger;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import static java.util.logging.Level.FINE;
@@ -56,6 +58,9 @@ public final class KeyVaultKeyStore extends KeyStoreSpi {
      */
     private static final Logger LOGGER = Logger.getLogger(KeyVaultKeyStore.class.getName());
 
+    static final String CERTIFICATE_ALIAS_FILTER_PATTERNS_PROPERTY
+        = "azure.keyvault.jca.certificate-alias-filter-patterns";
+
     /**
      * Stores the Jre key store certificates.
      */
@@ -146,9 +151,10 @@ public KeyVaultKeyStore() {
         customCertificates = SpecificPathCertificates.getSpecificPathCertificates(customPath);
         LOGGER.log(FINE, String.format("Loaded custom certificates: %s.", customCertificates.getAliases()));
 
-        keyVaultCertificates = new KeyVaultCertificates(refreshInterval, keyVaultUri, tenantId, clientId, clientSecret,
-            managedIdentity, accessToken, disableChallengeResourceVerification);
-        LOGGER.log(FINE, String.format("Loaded Key Vault certificates: %s.", keyVaultCertificates.getAliases()));
+        keyVaultCertificates
+            = new KeyVaultCertificates(refreshInterval, keyVaultUri, tenantId, clientId, clientSecret, managedIdentity,
+                accessToken, disableChallengeResourceVerification, getKeyVaultCertificateAliasFilterPatterns());
+        LOGGER.log(FINE, () -> String.format("Loaded Key Vault certificates: %s.", keyVaultCertificates.getAliases()));
 
         classpathCertificates = new ClasspathCertificates();
         LOGGER.log(FINE, String.format("Loaded classpath certificates: %s.", classpathCertificates.getAliases()));
@@ -168,6 +174,15 @@ Long getRefreshInterval() {
             .orElse(0L);
     }
 
+    Set<String> getKeyVaultCertificateAliasFilterPatterns() {
+        return Optional.ofNullable(System.getProperty(CERTIFICATE_ALIAS_FILTER_PATTERNS_PROPERTY))
+            .map(value -> Stream.of(value.split(","))
+                .map(String::trim)
+                .filter(pattern -> !pattern.isEmpty())
+                .collect(Collectors.toSet()))
+            .orElse(Collections.emptySet());
+    }
+
     /**
      * get key vault key store by system property
      *
@@ -254,16 +269,22 @@ public boolean engineEntryInstanceOf(String alias, Class<? extends KeyStore.Entr
      */
     @Override
     public Certificate engineGetCertificate(String alias) {
-        Certificate certificate = allCertificates.stream()
-            .map(AzureCertificates::getCertificates)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(certificates -> certificates.get(alias))
-            .orElse(null);
+        Certificate certificate = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                certificate = ((KeyVaultCertificates) certificatesSource).getCertificate(alias);
+            } else {
+                certificate = certificatesSource.getCertificates().get(alias);
+            }
+
+            if (certificate != null) {
+                break;
+            }
+        }
 
         if (refreshCertificatesWhenHaveUnTrustCertificate && certificate == null) {
             keyVaultCertificates.refreshCertificates();
-            certificate = keyVaultCertificates.getCertificates().get(alias);
+            certificate = keyVaultCertificates.getCertificate(alias);
         }
 
         return certificate;
@@ -283,7 +304,7 @@ public String engineGetCertificateAlias(Certificate cert) {
             List<String> aliasList = getAllAliases();
             for (String candidateAlias : aliasList) {
                 Certificate certificate = engineGetCertificate(candidateAlias);
-                if (certificate.equals(cert)) {
+                if (certificate != null && certificate.equals(cert)) {
                     alias = candidateAlias;
                     break;
                 }
@@ -307,16 +328,23 @@ public String engineGetCertificateAlias(Certificate cert) {
      */
     @Override
     public Certificate[] engineGetCertificateChain(String alias) {
-        Certificate[] certificates = allCertificates.stream()
-            .map(AzureCertificates::getCertificateChains)
-            .filter(Objects::nonNull)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(m -> m.get(alias))
-            .orElse(null);
+        Certificate[] certificates = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                certificates = ((KeyVaultCertificates) certificatesSource).getCertificateChain(alias);
+            } else {
+                Certificate[] certificateChain = certificatesSource.getCertificateChains().get(alias);
+                certificates = certificateChain == null ? null : certificateChain.clone();
+            }
+
+            if (certificates != null) {
+                break;
+            }
+        }
+
         if (refreshCertificatesWhenHaveUnTrustCertificate && certificates == null) {
             keyVaultCertificates.refreshCertificates();
-            return keyVaultCertificates.getCertificateChains().get(alias);
+            return keyVaultCertificates.getCertificateChain(alias);
         }
         return certificates;
     }
@@ -358,12 +386,20 @@ public KeyStore.Entry engineGetEntry(String alias, KeyStore.ProtectionParameter
      */
     @Override
     public Key engineGetKey(String alias, char[] password) {
-        return allCertificates.stream()
-            .map(AzureCertificates::getCertificateKeys)
-            .filter(a -> a.containsKey(alias))
-            .findFirst()
-            .map(certificateKeys -> certificateKeys.get(alias))
-            .orElse(null);
+        Key key = null;
+        for (AzureCertificates certificatesSource : allCertificates) {
+            if (certificatesSource instanceof KeyVaultCertificates) {
+                key = ((KeyVaultCertificates) certificatesSource).getCertificateKey(alias);
+            } else {
+                key = certificatesSource.getCertificateKeys().get(alias);
+            }
+
+            if (key != null) {
+                break;
+            }
+        }
+
+        return key;
     }
 
     /**