vault-auth-spire
vault-auth-spire copied to clipboard
bloomberg
vault-auth-spire is an authentication plugin for Hashicorp Vault which allows logging into Vault using a Spire provided SVID.
## Background Authentication using X509 SVIDs is a three-step process. 1. Prove client logging into Vault is the owner of the X509-SVID being passed in. 2. Prove the X509-SVID was...
The current implementation of [`SvidVerifier::Verify`](https://github.com/bloomberg/vault-auth-spire/blob/f2e20e33d85979aeb867a288d95d71efd0f541cf/internal/common/svidverifier.go#L49) assumes the SVID will be an [`x509-SVID`](https://github.com/spiffe/spiffe/blob/master/standards/X509-SVID.md) and doesn't consider the possibility of a [`JWT-SVID`](https://github.com/spiffe/spiffe/blob/master/standards/JWT-SVID.md). **Purpose**: This issue will track the discussion and implementation of...
One of the pieces of data returned from the [`pathAuthLogin`](https://github.com/bloomberg/vault-auth-spire/blob/develop/cmd/plugin/vault-auth-spire.go#L154) method is a list of Vault policy ids to apply to the login session. A core component of this plugin...