open-vault/api/auth/approle/approle.go

202 lines
5.5 KiB
Go

package approle
import (
"context"
"fmt"
"io"
"os"
"strings"
"github.com/hashicorp/vault/api"
)
type AppRoleAuth struct {
mountPath string
roleID string
secretID string
secretIDFile string
secretIDEnv string
unwrap bool
}
var _ api.AuthMethod = (*AppRoleAuth)(nil)
// SecretID is a struct that allows you to specify where your application is
// storing the secret ID required for login to the AppRole auth method. The
// recommended secure pattern is to use response-wrapping tokens rather than
// a plaintext value, by passing WithWrappingToken() to NewAppRoleAuth.
// https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
type SecretID struct {
// Path on the file system where the secret ID can be found.
FromFile string
// The name of the environment variable containing the application's
// secret ID.
FromEnv string
// The secret ID as a plaintext string value.
FromString string
}
type LoginOption func(a *AppRoleAuth) error
const (
defaultMountPath = "approle"
)
// NewAppRoleAuth initializes a new AppRole auth method interface to be
// passed as a parameter to the client.Auth().Login method.
//
// For a secret ID, the recommended secure pattern is to unwrap a one-time-use
// response-wrapping token that was placed here by a trusted orchestrator
// (https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices)
// To indicate that the filepath points to this wrapping token and not just
// a plaintext secret ID, initialize NewAppRoleAuth with the
// WithWrappingToken LoginOption.
//
// Supported options: WithMountPath, WithWrappingToken
func NewAppRoleAuth(roleID string, secretID *SecretID, opts ...LoginOption) (*AppRoleAuth, error) {
if roleID == "" {
return nil, fmt.Errorf("no role ID provided for login")
}
if secretID == nil {
return nil, fmt.Errorf("no secret ID provided for login")
}
err := secretID.validate()
if err != nil {
return nil, fmt.Errorf("invalid secret ID: %w", err)
}
a := &AppRoleAuth{
mountPath: defaultMountPath,
roleID: roleID,
}
// secret ID will be read in at login time if it comes from a file or environment variable, in case the underlying value changes
if secretID.FromFile != "" {
a.secretIDFile = secretID.FromFile
}
if secretID.FromEnv != "" {
a.secretIDEnv = secretID.FromEnv
}
if secretID.FromString != "" {
a.secretID = secretID.FromString
}
// Loop through each option
for _, opt := range opts {
// Call the option giving the instantiated
// *AppRoleAuth as the argument
err := opt(a)
if err != nil {
return nil, fmt.Errorf("error with login option: %w", err)
}
}
// return the modified auth struct instance
return a, nil
}
func (a *AppRoleAuth) Login(ctx context.Context, client *api.Client) (*api.Secret, error) {
loginData := map[string]interface{}{
"role_id": a.roleID,
}
var secretIDValue string
switch {
case a.secretIDFile != "":
s, err := a.readSecretIDFromFile()
if err != nil {
return nil, fmt.Errorf("error reading secret ID: %w", err)
}
secretIDValue = s
case a.secretIDEnv != "":
s := os.Getenv(a.secretIDEnv)
if s == "" {
return nil, fmt.Errorf("secret ID was specified with an environment variable %q with an empty value", a.secretIDEnv)
}
secretIDValue = s
default:
secretIDValue = a.secretID
}
// if the caller indicated that the value was actually a wrapping token, unwrap it first
if a.unwrap {
unwrappedToken, err := client.Logical().Unwrap(secretIDValue)
if err != nil {
return nil, fmt.Errorf("unable to unwrap response wrapping token: %w", err)
}
loginData["secret_id"] = unwrappedToken.Data["secret_id"]
} else {
loginData["secret_id"] = secretIDValue
}
path := fmt.Sprintf("auth/%s/login", a.mountPath)
resp, err := client.Logical().Write(path, loginData)
if err != nil {
return nil, fmt.Errorf("unable to log in with app role auth: %w", err)
}
return resp, nil
}
func WithMountPath(mountPath string) LoginOption {
return func(a *AppRoleAuth) error {
a.mountPath = mountPath
return nil
}
}
func WithWrappingToken() LoginOption {
return func(a *AppRoleAuth) error {
a.unwrap = true
return nil
}
}
func (a *AppRoleAuth) readSecretIDFromFile() (string, error) {
secretIDFile, err := os.Open(a.secretIDFile)
if err != nil {
return "", fmt.Errorf("unable to open file containing secret ID: %w", err)
}
defer secretIDFile.Close()
limitedReader := io.LimitReader(secretIDFile, 1000)
secretIDBytes, err := io.ReadAll(limitedReader)
if err != nil {
return "", fmt.Errorf("unable to read secret ID: %w", err)
}
secretIDValue := strings.TrimSuffix(string(secretIDBytes), "\n")
return secretIDValue, nil
}
func (secretID *SecretID) validate() error {
if secretID.FromFile == "" && secretID.FromEnv == "" && secretID.FromString == "" {
return fmt.Errorf("secret ID for AppRole must be provided with a source file, environment variable, or plaintext string")
}
if secretID.FromFile != "" {
if secretID.FromEnv != "" || secretID.FromString != "" {
return fmt.Errorf("only one source for the secret ID should be specified")
}
}
if secretID.FromEnv != "" {
if secretID.FromFile != "" || secretID.FromString != "" {
return fmt.Errorf("only one source for the secret ID should be specified")
}
}
if secretID.FromString != "" {
if secretID.FromFile != "" || secretID.FromEnv != "" {
return fmt.Errorf("only one source for the secret ID should be specified")
}
}
return nil
}