I'm using vault.auth.method=Token to authenticate with Vault, but I've observed that token renewal does not work.
PR #344 introduced token renewal for AppRole, which tries to renew when the initial AuthResult has a TTL > 0.
|
if (result.ttl().isPresent() && result.ttl().get() > 0) { |
|
log.debug("ctor() - AuthResult does have a ttl - scheduling token renewal."); |
|
executorService.scheduleAtFixedRate(() -> authenticateVault(config, vaultConfig), |
|
0, result.ttl().get() - (result.ttl().get() / 10), TimeUnit.SECONDS); |
|
} else { |
|
log.debug("ctor() - AuthResult does not have a ttl so not scheduling token refresh."); |
|
} |
The scheduled task triggers authentication, which works for AppRole.
However this implementation currently does not work with the Token method.
For the Token method, authentication only calls auth/token/lookup-self, which does not renew. It should also call auth/token/renew-self.
|
static class Token extends AuthHandler { |
|
|
|
@Override |
|
public AuthMethod method() { |
|
return AuthMethod.Token; |
|
} |
|
|
|
@Override |
|
public AuthResult execute(VaultConfigProviderConfig config, Vault vault) throws VaultException { |
|
LookupResponse lookupResponse = vault.auth().lookupSelf(); |
|
return result(lookupResponse); |
|
} |
|
} |
I'm using
vault.auth.method=Tokento authenticate with Vault, but I've observed that token renewal does not work.PR #344 introduced token renewal for
AppRole, which tries to renew when the initialAuthResulthas a TTL > 0.csid-secrets-providers/vault/src/main/java/io/confluent/csid/config/provider/vault/VaultClientImpl.java
Lines 152 to 158 in a41ab29
The scheduled task triggers authentication, which works for
AppRole.However this implementation currently does not work with the
Tokenmethod.For the
Tokenmethod, authentication only callsauth/token/lookup-self, which does not renew. It should also callauth/token/renew-self.csid-secrets-providers/vault/src/main/java/io/confluent/csid/config/provider/vault/AuthHandler.java
Lines 183 to 195 in a41ab29