Token authentication method for HashiCorp Vault.

This module implements comprehensive token management for Vault, providing functionality for token creation, lookup, renewal, and revocation. Unlike other authentication methods that obtain tokens, this module manages existing tokens and provides token-based operations.

Features

• Token Creation: Create new tokens with configurable policies and TTL
• Token Lookup: Retrieve information about existing tokens
• Token Renewal: Extend token lifetime within configured limits
• Token Revocation: Safely revoke tokens and associated leases
• Role Management: Support for token roles with predefined configurations
• Accessor Operations: Manage tokens via their accessor IDs
• Enterprise Ready: Supports all Vault enterprise features

API Compliance

Fully implements HashiCorp Vault Token authentication:

• Token Auth Method
• Token Auth Configuration

Usage Examples

Token Lookup (Self)

{:ok, token_info} = Vaultx.Auth.Token.lookup_self()

Token Lookup (Specific Token)

{:ok, token_info} = Vaultx.Auth.Token.lookup_token("hvs.CAESIJ...")

Token Creation

{:ok, auth_response} = Vaultx.Auth.Token.create_token(%{
  policies: ["default", "myapp"],
  ttl: "1h",
  renewable: true
})

Token Renewal

{:ok, auth_response} = Vaultx.Auth.Token.renew_token("hvs.CAESIJ...", %{
  increment: "30m"
})

Token Revocation

:ok = Vaultx.Auth.Token.revoke_token("hvs.CAESIJ...")

Vault Configuration

The token auth method is enabled by default in Vault:

# Token auth is always available at auth/token/
# No additional configuration required

# Create token roles (optional)
vault write auth/token/roles/myapp \
  allowed_policies="default,myapp" \
  orphan=true \
  renewable=true

Security Considerations

• Use appropriate token TTL values to minimize exposure
• Implement proper token rotation strategies
• Monitor token usage and revoke unused tokens
• Use token roles to enforce consistent policies
• Regularly audit token permissions and usage
• Consider using batch tokens for high-volume scenarios