Merge pull request #1692 from hashicorp/ttl0-not-renewable

Don't mark never-expiring root tokens as renewable

http/logical_test.go

@@ -192,7 +192,7 @@ func TestLogical_CreateToken(t *testing.T) {
 			"policies":       []interface{}{"root"},
 			"metadata":       nil,
 			"lease_duration": json.Number("0"),
-			"renewable":      true,
+			"renewable":      false,
 		},
 		"warnings": nilWarnings,
 	}

vault/token_store.go

@@ -1296,6 +1296,11 @@ func (ts *TokenStore) handleCreateCommon(
 		}
 	}
 
+	// Don't advertise non-expiring root tokens as renewable, as attempts to renew them are denied
+	if te.TTL == 0 {
+		renewable = false
+	}
+
 	// Create the token
 	if err := ts.create(&te); err != nil {
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest