Hashicorp vault

[roflhouse]

It would be great if you could add support for hashicorps vault as a password manager. It has a cli and a rest api and a python module. It’s pretty common I the enterprise space and the custom provider takes a bit of hacking to get to some what work. I think supporting just the kv backend would go a long way. However you would likely need 2 keys one for the path one for the secret.

[crschnick]

I will experiment with the vault CLI to see how it handles

[roflhouse]

Actually just an option to remove the added quotes for the KEY value the vault would help. The key for vault is two values separated by a space right now I have to inject quotes to work around it

[crschnick]

Alright, I will put that on the TODO list for v22

[crschnick]

So I looked into this and was a bit confused by its complexity.

Is this the correct way to configure?

[roflhouse]

So Vault supports a ton of authentication methods. If you are attempting to wrap the entire login API that will take some doing. This link is the python api docs which documents the login methods https://python-hvac.org/en/stable/usage/auth_methods/index.html.

If you are just wrapping the vault cli then most of this could probably just be a generic command line arguments. However, the vault api and the cli support environment variables for most things.

the namespace is basically so they can have multiple password mangers in one. it applies to both the login and get commands as far as I understand. So, you can get passwords from multiple namespaces. I don't use them so I am not that familiar but if the goal is to support them, they would be another item likely in the key as well. Think of it like a path you can login to /foo/bar but then you can't get from /foo/otherbar but if you login to /foo you can get from both.

Here is my login command for example
vault login -method=oidc

the vault url is an environment variable and the namespace and role are defaults, but you can provide them
vault login -namespace="foo/bar" -address="https://" -method=oidc role=bar

vault's auth methods as far as i understand all generate a token stored in ~/.vault-token which it uses to actually pull secrets so if your goal isn't to login then you can probably check for the validity of that token and/or use it. I think "vault token lookup" will return failure if your token is not valid.

The other half of vault is that it supports many secret engines for storing/generating temporary passwords. I think the most similar and simple secret manager is the KV or key/value store which is probably what you are expecting to see. Here is an example of pulling a secret from that engine.
vault kv get -field=PASSWORD_NAME kv/path/to/secret
vault kv get -address="http://" -namespce="foo/bar" -field=PASSWORD_NAME kv/path/to/secret

the kv is a bit weird the path is a path to a json dictionary, and the field is an element in that dictionary.

if you want to support the generic secret reading which is supposed to all the engines it would look something like
vault read kv/data/path/to/secret
then you would need to parse the json for the actual password from the json block of multiple passwords. Using the generic is tricky cause you kind of have to know what the data format you will get back is supposed to be and parse it.