Read input for passcode to vault login function does not work

[demizer]

Hi all,

I'm a new fish user and I am trying to implement a function to make entering MFA tokens easier for vault.

My function:

function vault-login
     set -l fish_trace on
     read --nchars=6 --prompt-str='Enter MFA token: ' -L -U passcode
     vault login -method=ldap username=myuser passcode=$passcode
end

Where output is:

$ vault-login
--> read --nchars=6 '--prompt-str=Enter MFA token: ' -L -U passcode

Enter MFA token: 345550
--> vault login -method=ldap username=myuser passcode=345550
Password (will be hidden):
Error authenticating: Error making API request.

URL: PUT https://vault/v1/auth/ldap/login/myuser
Code: 400. Errors:

* ldap operation failed: failed to bind as user

Now if I take the output from trace and paste it in my terminal and run again, it works.

Something is happening with read that I don't understand.

Some other stuff I tried:

• -U is just an attempt to get it to work, I have also tried -l and -x.
• If I create a bash function exactly like this function, it works.
• Make the function accept an argument for the passcode also works, but it's not as cool.
• I tried using passcode=(read ...) and that did not work

My guess is read (or fish) is silently adding to the passcode variable or doing something with vaults stdin, but I have no idea how to check that.

Any help would be greatly appreciated!

[faho]

After the read, add in this:

set --show passcode

That will show you exactly what $passcode contains.

[faho]

Note:

Password (will be hidden):

This looks like it doesn't think it has a passcode.

-U is just an attempt to get it to work, I have also tried -l and -x.

Yeah, that has absolutely no bearing on this situation. -U means it sets the variable in universal scope (and -l makes it a local variable).

You are just using the variable immediately so scoping doesn't factor into it. You should always use the smallest scope you can, so -l is correct here.

vault login -method=ldap username=myuser passcode=345550

If you execute this directly in your commandline, does it work?

[demizer]

Yes if I execute it directly, enter the password (copy/paste) it works.

[demizer]

I added the suggested show passcode and the token looks clean:

$ vault-login
--> read --nchars=6 '--prompt-str=Enter MFA token: ' -l passcode

Enter MFA token: 682623
--> set --show passcode
$passcode: set in local scope, unexported, with 1 elements
$passcode[1]: |682623|
$passcode: set in universal scope, unexported, with 0 elements
--> vault login -method=ldap -namespace=cuda-installer-automation username=jesusa passcode=682623
Password (will be hidden):
Error authenticating: Error making API request.

URL: PUT https://stg.vault.nvidia.com/v1/auth/ldap/login/jesusa
Code: 400. Errors:

* ldap operation failed: failed to bind as user

Here is the updated function:

function vault-login
    # vault login -method=ldap -namespace=cuda-installer-automation username=jesusa passcode=$argv
    set -l fish_trace on
    read --nchars=6 --prompt-str='Enter MFA token: ' -l passcode
    set --show passcode
    vault login -method=ldap -namespace=cuda-installer-automation username=jesusa passcode=$passcode
end