Native Login method for Go client

api/auth.go

@@ -1,11 +1,34 @@
 package api
 
+import "fmt"
+
 // Auth is used to perform credential backend related operations.
 type Auth struct {
 	c *Client
 }
 
+type AuthMethod interface {
+	Login(client *Client) (*Secret, error)
+}
+
 // Auth is used to return the client for credential-backend API calls.
 func (c *Client) Auth() *Auth {
 	return &Auth{c: c}
 }
+
+// Login sets up the required request body for login requests to the given auth method's /login API endpoint, and then performs a write to it. After a successful login, this method will automatically set the client's token to the login response's ClientToken as well.
+// The Secret returned is the authentication secret, which if desired can be passed as input to the NewLifetimeWatcher method in order to start automatically renewing the token.
+func (a *Auth) Login(authMethod AuthMethod) (*Secret, error) {
+	if authMethod == nil {
+		return nil, fmt.Errorf("no auth method provided for login")
+	}
+
+	authSecret, err := authMethod.Login(a.c)
+	if err != nil {
+		return nil, fmt.Errorf("unable to log in to auth method: %w", err)
+	}
+
+	a.c.SetToken(authSecret.Auth.ClientToken)
+
+	return authSecret, nil
+}

auth/approle/approle.go

@@ -0,0 +1,97 @@
+package approle
+
+import (
+	"fmt"
+	"io/ioutil"
+	"strings"
+
+	"github.com/hashicorp/vault/api"
+)
+
+type AppRoleAuth struct {
+	mountPath      string
+	roleID         string
+	pathToSecretID string
+	unwrap         bool
+}
+
+type LoginOption func(a *AppRoleAuth)
+
+// NewAppRoleAuth initializes a new AppRole auth method interface to be passed as a parameter to the client.Auth().Login method.
+//
+// For a secret ID, the recommended secure pattern is to unwrap a one-time-use response-wrapping token that was placed here by a trusted orchestrator (https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices)
+// To indicate that the filepath points to this wrapping token and not just a plaintext secret ID, initialize NewAppRoleAuth with the WithWrappingToken LoginOption.
+//
+// Supported options: WithMountPath, WithWrappingToken
+func NewAppRoleAuth(roleID, pathToSecretID string, opts ...LoginOption) (api.AuthMethod, error) {
+	if roleID == "" {
+		return nil, fmt.Errorf("no role ID provided for login")
+	}
+
+	if pathToSecretID == "" {
+		return nil, fmt.Errorf("no path to secret ID provided for login")
+	}
+
+	const (
+		defaultMountPath = "approle"
+	)
+
+	a := &AppRoleAuth{
+		mountPath:      defaultMountPath,
+		roleID:         roleID,
+		pathToSecretID: pathToSecretID,
+	}
+
+	// Loop through each option
+	for _, opt := range opts {
+		// Call the option giving the instantiated
+		// *AppRoleAuth as the argument
+		opt(a)
+	}
+
+	// return the modified auth struct instance
+	return a, nil
+}
+
+func (a *AppRoleAuth) Login(client *api.Client) (*api.Secret, error) {
+	loginData := map[string]interface{}{
+		"role_id": a.roleID,
+	}
+
+	secretIDBytes, err := ioutil.ReadFile(a.pathToSecretID)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read file containing secret ID: %w", err)
+	}
+	secretID := string(secretIDBytes)
+
+	// if it was indicated that the value in the file was actually a wrapping token, unwrap it first
+	if a.unwrap {
+		unwrappedToken, err := client.Logical().Unwrap(strings.TrimSuffix(secretID, "\n"))
+		if err != nil {
+			return nil, fmt.Errorf("unable to unwrap token: %w. If the AppRoleAuth struct was initialized with the WithWrappingToken LoginOption, then the filepath used should be a path to a response-wrapping token", err)
+		}
+		loginData["secret_id"] = unwrappedToken.Data["secret_id"]
+	} else {
+		loginData["secret_id"] = secretID
+	}
+
+	path := fmt.Sprintf("auth/%s/login", a.mountPath)
+	resp, err := client.Logical().Write(path, loginData)
+	if err != nil {
+		return nil, fmt.Errorf("unable to log in with app role auth: %w", err)
+	}
+
+	return resp, nil
+}
+
+func WithMountPath(mountPath string) LoginOption {
+	return func(a *AppRoleAuth) {
+		a.mountPath = mountPath
+	}
+}
+
+func WithWrappingToken() LoginOption {
+	return func(a *AppRoleAuth) {
+		a.unwrap = true
+	}
+}

auth/approle/approle_test.go

@@ -0,0 +1,98 @@
+package approle
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/vault/api"
+)
+
+// testHTTPServer creates a test HTTP server that handles requests until
+// the listener returned is closed.
+func testHTTPServer(
+	t *testing.T, handler http.Handler) (*api.Config, net.Listener) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	server := &http.Server{Handler: handler}
+	go server.Serve(ln)
+
+	config := api.DefaultConfig()
+	config.Address = fmt.Sprintf("http://%s", ln.Addr())
+
+	return config, ln
+}
+
+func init() {
+	os.Setenv("VAULT_TOKEN", "")
+}
+func TestLogin(t *testing.T) {
+	allowedRoleID := "my-role-id"
+	allowedSecretID := "my-secret-id"
+
+	content := []byte(allowedSecretID)
+	tmpfile, err := os.CreateTemp("", "file-containing-secret-id")
+	if err != nil {
+		t.Fatalf("error creating temp file: %v", err)
+	}
+	defer os.Remove(tmpfile.Name()) // clean up
+
+	if _, err := tmpfile.Write(content); err != nil {
+		t.Fatalf("error writing to temp file: %v", err)
+	}
+	if err := tmpfile.Close(); err != nil {
+		t.Fatalf("error closing temp file: %v", err)
+	}
+
+	// a response to return if the correct values were passed to login
+	authSecret := &api.Secret{
+		Auth: &api.SecretAuth{
+			ClientToken: "a-client-token",
+		},
+	}
+
+	authBytes, err := json.Marshal(authSecret)
+	if err != nil {
+		t.Fatalf("error marshaling json: %v", err)
+	}
+
+	handler := func(w http.ResponseWriter, req *http.Request) {
+		payload := make(map[string]interface{})
+		err := json.NewDecoder(req.Body).Decode(&payload)
+		if err != nil {
+			t.Fatalf("error decoding json: %v", err)
+		}
+		if payload["role_id"] == allowedRoleID && payload["secret_id"] == allowedSecretID {
+			w.Write(authBytes)
+		}
+	}
+
+	config, ln := testHTTPServer(t, http.HandlerFunc(handler))
+	defer ln.Close()
+
+	config.Address = strings.ReplaceAll(config.Address, "127.0.0.1", "localhost")
+	client, err := api.NewClient(config)
+	if err != nil {
+		t.Fatalf("error initializing Vault client: %v", err)
+	}
+
+	appRoleAuth, err := NewAppRoleAuth("my-role-id", tmpfile.Name())
+	if err != nil {
+		t.Fatalf("error initializing AppRoleAuth: %v", err)
+	}
+
+	authInfo, err := client.Auth().Login(appRoleAuth)
+	if err != nil {
+		t.Fatalf("error logging in: %v", err)
+	}
+	if authInfo == nil {
+		t.Fatalf("no authentication info returned by login")
+	}
+}