Add command and token store documentation for roles

command/token_create.go

@@ -105,6 +105,8 @@ Usage: vault token-create [options]
   Metadata associated with the token (specified with "-metadata") is
   written to the audit log when the token is used.
 
+  If a role is specified, the role may override parameters specified here.
+
 General Options:
 
   ` + generalOptionsUsage() + `
@@ -145,6 +147,10 @@ Token Options:
   -format=table           The format for output. By default it is a whitespace-
                           delimited table. This can also be json or yaml.
 
+  -role=name              If set, the token will be created against the named
+                          role. The role may override other parameters. This
+                          requires the client to have permissions on the
+                          appropriate endpoint (auth/token/create/<name>).
 `
 	return strings.TrimSpace(helpText)
 }

vault/token_store.go

@@ -101,8 +101,8 @@ func NewTokenStore(c *Core, config *logical.BackendConfig) (*TokenStore, error)
 					logical.ListOperation: t.tokenStoreRoleList,
 				},
 
-				//				HelpSynopsis:    pathRoleHelpSyn,
-				//				HelpDescription: pathRoleHelpDesc,
+				HelpSynopsis:    tokenListRolesHelp,
+				HelpDescription: tokenListRolesHelp,
 			},
 
 			&framework.Path{
@@ -159,8 +159,8 @@ expression ` + prefixSanitize.String(),
 					logical.DeleteOperation: t.tokenStoreRoleDelete,
 				},
 
-				//				HelpSynopsis:    pathRoleHelpSyn,
-				//				HelpDescription: pathRoleHelpDesc,
+				HelpSynopsis:    tokenPathRolesHelp,
+				HelpDescription: tokenPathRolesHelp,
 			},
 
 			&framework.Path{
@@ -188,8 +188,8 @@ expression ` + prefixSanitize.String(),
 					logical.UpdateOperation: t.handleCreateRole,
 				},
 
-				//HelpSynopsis:    strings.TrimSpace(tokenCreateOrphanHelp),
-				//HelpDescription: strings.TrimSpace(tokenCreateOrphanHelp),
+				HelpSynopsis:    strings.TrimSpace(tokenCreateRoleHelp),
+				HelpDescription: strings.TrimSpace(tokenCreateRoleHelp),
 			},
 
 			&framework.Path{
@@ -1239,7 +1239,10 @@ which are enforced on every request. This backend also allows for generating sub
 as revocation of tokens. The tokens are renewable if associated with a lease.`
 	tokenCreateHelp       = `The token create path is used to create new tokens.`
 	tokenCreateOrphanHelp = `The token create path is used to create new orphan tokens.`
+	tokenCreateRoleHelp   = `This token create path is used to create new tokens adhering to the given role.`
+	tokenListRolesHelp    = `This endpoint lists configured roles.`
 	tokenLookupHelp       = `This endpoint will lookup a token and its properties.`
+	tokenPathRolesHelp    = `This endpoint allows creating, reading, and deleting roles.`
 	tokenRevokeHelp       = `This endpoint will delete the given token and all of its child tokens.`
 	tokenRevokeSelfHelp   = `This endpoint will delete the token used to call it and all of its child tokens.`
 	tokenRevokeOrphanHelp = `This endpoint will delete the token and orphan its child tokens.`