Creating IVaultClient based on the Environment

[bijumrs]

Since vault can be connected in different ways, can we write an application using this library, without using any specific authentication method (like token, iam etc..) and the library internally detects the best way to connect to ? Basically, looking for some predefined properties in the environment which the library will look for to determine what authn method to use - something like Spring's EnvironmentVaultConfiguration - https://docs.spring.io/spring-vault/docs/current/api/org/springframework/vault/config/EnvironmentVaultConfiguration.html

[rajanadar]

@bijumrs That's a good thought, but it is left for the host applications to do all that discovery, dynamicity and magic.
VaultSharp takes an interface for AuthInfo, so it is very conducive that way in terms of polymorphism.

Also EnvironmentVaultConfiguration is just a file based way of providing "Token Auth" and Vault-URL. It doesn't have any dynamic "let me determine the auth method" capability. It uses Token Auth.

What you're suggesting is a higher level dynamic feature, best left for the host applications to do.

[bijumrs]

@rajanadar Appreciate the response. I agree this can be implemented by the host applications, but I think it is a common use case and it is better to be supported by the library, may be a candidate for future enhancement?

While TokenAuth is the default auth method of EnvironmentVaultConfiguration , it can be switched based on the vault.authentication property, based on the following implementation of clientAuthentication()

@OverRide
public ClientAuthentication clientAuthentication() {

String authentication = getProperty("vault.authentication", AuthenticationMethod.TOKEN.name()).toUpperCase()
.replace('-', '_');

AuthenticationMethod authenticationMethod = AuthenticationMethod.valueOf(authentication);

switch (authenticationMethod) {

case TOKEN:
return tokenAuthentication();
case APPID:
return appIdAuthentication();
case APPROLE:
return appRoleAuthentication();
case AWS_EC2:
return awsEc2Authentication();
case AZURE:
return azureMsiAuthentication();
case CERT:
return new ClientCertificateAuthentication(restOperations());
case CUBBYHOLE:
return cubbyholeAuthentication();
case KUBERNETES:
return kubeAuthentication();
default:
throw new IllegalStateException(String.format("Vault authentication method %s is not supported with %s",
authenticationMethod, getClass().getSimpleName()));
}
}

[rajanadar]

Thanks for the explanation @bijumrs.

It still feels like a host or a vault-contrib capability, and not a core vault-sharp library capability. I tend to avoid file processing in the library and prefer the host app to do whatever it needs to do to create the IAuthInfo instance.