英文:
Get secret from hashicorp vault using java application with service token
问题
以下是您要翻译的内容：
也许有人可以帮助我理解我错过了什么。
我使用这样的示例来设置 cloud-config 服务，与另一个使用 Vault 获取一些机密信息的 Spring 应用程序配合使用。
如果我使用 root 令牌，一切正常运行。
但是一旦我创建了带有策略的 service 令牌
path "secret/data/test*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/test*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
我可以用以下方式验证它
$ vault token capabilities secret/test
create, delete, list, read, update
以及用 curl
$ curl \
--header "X-Vault-Token: $VAULT_TOKEN" \
http://<dns-name>:8200/v1/secret/data/test | jq .
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 302 100 302 0 0 2796 0 --:--:-- --:--:-- --:--:-- 2796
{
"request_id": "44b5fdcf-a13c-8e12-83f3-a5064f25257d",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"data": {
"test-key": "test-value"
},
"metadata": {
"created_time": "2020-04-09T21:11:28.899688798Z",
"deletion_time": "",
"destroyed": false,
"version": 1
}
},
"wrap_info": null,
"warnings": null,
"auth": null
}
但是一旦我开始将此令牌与应用程序一起使用，它返回
2020-04-10 13:38:43.186 DEBUG 43843 --- [nio-8888-exec-1] org.apache.http.wire: http-outgoing-0 >> “GET /v1/secret/data/test HTTP/1.1[\r][\n]”
http-outgoing-0 >> “X-Vault-Token: <TOKEN>[\r][\n]”
Response 403 FORBIDDEN
英文:
Maybe some could help me understand where I missed something.
I use such example to set-up cloud-config service, with another spring application which is used vault to get some secrets.
If I using root token everything is working correctly.
But once I create service token with policy
path "secret/data/test*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/test*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
I can validate it with
$ vault token capabilities secret/test
create, delete, list, read, update
and with curl
$ curl \
--header "X-Vault-Token: $VAULT_TOKEN" \
http://<dns-name>:8200/v1/secret/data/test | jq .
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 302 100 302 0 0 2796 0 --:--:-- --:--:-- --:--:-- 2796
{
"request_id": "44b5fdcf-a13c-8e12-83f3-a5064f25257d",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"data": {
"test-key": "test-value"
},
"metadata": {
"created_time": "2020-04-09T21:11:28.899688798Z",
"deletion_time": "",
"destroyed": false,
"version": 1
}
},
"wrap_info": null,
"warnings": null,
"auth": null
}
but once I start using this token with the application it returns
2020-04-10 13:38:43.186 DEBUG 43843 --- [nio-8888-exec-1] org.apache.http.wire: http-outgoing-0 >> “GET /v1/secret/data/test HTTP/1.1[\r][\n]”
http-outgoing-0 >> “X-Vault-Token: <TOKEN>[\r][\n]”
Response 403 FORBIDDEN
答案1
得分: 1
确实听起来应用程序没有正确附加凭据。尝试访问类似 httpbin 的网站。
/anything 将返回它收到的请求。这是一种调试这些服务的简便方法。
如果你担心这些凭据，你还可以在本地托管该网站。
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论