agent: allow AppRole Auto-Auth when bind_secret_id = false #6324
Conversation
New feature driven by our requirements. I believe it would be nice to have.
| @@ -180,9 +196,6 @@ func (a *approleMethod) Authenticate(ctx context.Context, client *api.Client) (s | |||
| } | |||
| } | |||
|
|
|||
| if a.cachedRoleID == "" { | |||
There was a problem hiding this comment.
What's the purpose of removing this?
There was a problem hiding this comment.
Hi @jefferai, it was not removed, just moved few lines above: https://github.com/hashicorp/vault/pull/6324/files/8e9029c6b9d1489f4606c126d306eeec1aa368b8#diff-fa73d70313fadbda55b7ae69904d6349R115
The reason being the fact that we return in https://github.com/hashicorp/vault/pull/6324/files/8e9029c6b9d1489f4606c126d306eeec1aa368b8#diff-fa73d70313fadbda55b7ae69904d6349R120 whenever we are trying to authenticate with just the role_id
| @@ -21,6 +21,7 @@ type approleMethod struct { | |||
|
|
|||
| roleIDFilePath string | |||
| secretIDFilePath string | |||
| secretIDLessMode bool | |||
There was a problem hiding this comment.
Is there a reason you need this bool? Seems like simply checking the path for emptiness should be sufficient.
There was a problem hiding this comment.
👍 You are right, PR updated
| @@ -180,9 +196,6 @@ func (a *approleMethod) Authenticate(ctx context.Context, client *api.Client) (s | |||
| } | |||
| } | |||
|
|
|||
| if a.cachedRoleID == "" { | |||
There was a problem hiding this comment.
Hi @jefferai, it was not removed, just moved few lines above: https://github.com/hashicorp/vault/pull/6324/files/8e9029c6b9d1489f4606c126d306eeec1aa368b8#diff-fa73d70313fadbda55b7ae69904d6349R115
The reason being the fact that we return in https://github.com/hashicorp/vault/pull/6324/files/8e9029c6b9d1489f4606c126d306eeec1aa368b8#diff-fa73d70313fadbda55b7ae69904d6349R120 whenever we are trying to authenticate with just the role_id
| @@ -21,6 +21,7 @@ type approleMethod struct { | |||
|
|
|||
| roleIDFilePath string | |||
| secretIDFilePath string | |||
| secretIDLessMode bool | |||
There was a problem hiding this comment.
👍 You are right, PR updated
Currently, if you have an AppRole configured with
bind_secret_id = falseand at least a constraint, you can login with just therole_id.Vault agent doesn't support this method for Auto-Auth as it expects a mandatory
secret_id_file_path.Changes:
secret_id_file_pathoptional.The code should be self-explanatory but there's always room for improvements 😄
I hope to see this merged at some point, I hate maintaining forks 😀