SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow fallback to ~/.vault-token file using Token authentication.

Browse Source 
This assists in usability of spring cloud vault locally after authenticating to vault via the vault CLI.

Closes gh-609
Original pull request: gh-614
This commit is contained in:
Brant
2021-09-27 09:05:59 -04:00
committed by Mark Paluch
parent 956052645c
commit a588534dfe
2 changed files with 38 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/src/main/asciidoc/authentication.adoc
View File

@@ -11,6 +11,7 @@ Spring Cloud Vault supports token and AppId authentication.
Tokens are the core method for authentication within Vault.
Token authentication requires a static token to be provided using the
https://github.com/spring-cloud/spring-cloud-commons/blob/master/docs/src/main/asciidoc/spring-cloud-commons.adoc#the-bootstrap-application-context[Bootstrap Application Context].
As a fallback the token may also be retrieved from ~/.vault-token which is the default location used by the Vault CLI to cache a token.
NOTE: Token authentication is the default authentication method.
If a token is disclosed an unintended party gains access to Vault and can access secrets for the intended client.
@@ -26,9 +27,13 @@ spring.cloud.vault:
====
* `authentication` setting this value to `TOKEN` selects the Token authentication method
* `token` sets the static token to use
* `token` sets the static token to use. If missing or empty, then an attempt will be made to retrieve a token from ~/.vault-token.
See also: https://www.vaultproject.io/docs/concepts/tokens.html[Vault Documentation: Tokens]
See also:
* https://www.vaultproject.io/docs/concepts/tokens.html[Vault Documentation: Tokens]
* https://www.vaultproject.io/docs/commands/login[Vault Documentation: CLI login]
* https://www.vaultproject.io/docs/commands/token-helper[Vault Documentation: CLI default to ~/.vault-token]
[[vault.config.authentication.vault-agent]]
=== Vault Agent authentication