AppRole Auth Method

package main

import (
    "context"
    "fmt"
    "os"

    vault "github.com/hashicorp/vault/api"
    auth "github.com/hashicorp/vault/api/auth/approle"
)

// Fetches a key-value secret (kv-v2) after authenticating via AppRole.
func getSecretWithAppRole() (string, error) {
    config := vault.DefaultConfig() // modify for more granular configuration

    client, err := vault.NewClient(config)
    if err != nil {
        return "", fmt.Errorf("unable to initialize Vault client: %w", err)
    }

    // A combination of a Role ID and Secret ID is required to log in to Vault
    // with an AppRole.
    // First, let's get the role ID given to us by our Vault administrator.
    roleID := os.Getenv("APPROLE_ROLE_ID")
    if roleID == "" {
        return "", fmt.Errorf("no role ID was provided in APPROLE_ROLE_ID env var")
    }

    // The Secret ID is a value that needs to be protected, so instead of the
    // app having knowledge of the secret ID directly, we have a trusted orchestrator (https://learn.hashicorp.com/tutorials/vault/secure-introduction?in=vault/app-integration#trusted-orchestrator)
    // give the app access to a short-lived response-wrapping token (https://www.vaultproject.io/docs/concepts/response-wrapping).
    // Read more at: https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
    secretID := &auth.SecretID{FromFile: "path/to/wrapping-token"}

    appRoleAuth, err := auth.NewAppRoleAuth(
        roleID,
        secretID,
        auth.WithWrappingToken(), // Only required if the secret ID is response-wrapped.
    )
    if err != nil {
        return "", fmt.Errorf("unable to initialize AppRole auth method: %w", err)
    }

    authInfo, err := client.Auth().Login(context.Background(), appRoleAuth)
    if err != nil {
        return "", fmt.Errorf("unable to login to AppRole auth method: %w", err)
    }
    if authInfo == nil {
        return "", fmt.Errorf("no auth info was returned after login")
    }

    // get secret from the default mount path for KV v2 in dev mode, "secret"
    secret, err := client.KVv2("secret").Get(context.Background(), "creds")
    if err != nil {
        return "", fmt.Errorf("unable to read secret: %w", err)
    }

    // data map can contain more than one key-value pair,
    // in this case we're just grabbing one of them
    value, ok := secret.Data["password"].(string)
    if !ok {
        return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
    }

    return value, nil
}

using System;
using System.Collections.Generic;
using System.IO;
using VaultSharp;
using VaultSharp.V1.AuthMethods;
using VaultSharp.V1.AuthMethods.AppRole;
using VaultSharp.V1.AuthMethods.Token;
using VaultSharp.V1.Commons;

namespace Examples
{
    public class ApproleAuthExample
    {
        const string DefaultTokenPath = "../../../path/to/wrapping-token";

        /// <summary>
        /// Fetches a key-value secret (kv-v2) after authenticating to Vault via AppRole authentication
        /// </summary>
        public string GetSecretWithAppRole()
        {
            // A combination of a Role ID and Secret ID is required to log in to Vault with an AppRole.
            // The Secret ID is a value that needs to be protected, so instead of the app having knowledge of the secret ID directly,
            // we have a trusted orchestrator (https://learn.hashicorp.com/tutorials/vault/secure-introduction?in=vault/app-integration#trusted-orchestrator)
            // give the app access to a short-lived response-wrapping token (https://www.vaultproject.io/docs/concepts/response-wrapping).
            // Read more at: https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
            var vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
            if(String.IsNullOrEmpty(vaultAddr))
            {
                throw new System.ArgumentNullException("Vault Address");
            }

            var roleId = Environment.GetEnvironmentVariable("APPROLE_ROLE_ID");
            if(String.IsNullOrEmpty(roleId))
            {
                throw new System.ArgumentNullException("AppRole Role Id");
            }
            // Get the path to wrapping token or fall back on default path
            string pathToToken = !String.IsNullOrEmpty(Environment.GetEnvironmentVariable("WRAPPING_TOKEN_PATH")) ? Environment.GetEnvironmentVariable("WRAPPING_TOKEN_PATH") : DefaultTokenPath;
            string wrappingToken = File.ReadAllText(pathToToken); // placed here by a trusted orchestrator

            // We need to create two VaultClient objects for authenticating via AppRole. The first is for
            // using the unwrap utility. We need to initialize the client with the wrapping token.
            IAuthMethodInfo wrappedTokenAuthMethod = new TokenAuthMethodInfo(wrappingToken);
            var vaultClientSettingsForUnwrapping = new VaultClientSettings(vaultAddr, wrappedTokenAuthMethod);

            IVaultClient vaultClientForUnwrapping = new VaultClient(vaultClientSettingsForUnwrapping);

            // We pass null here instead of the wrapping token to avoid depleting its single usage
            // given that we already initialized our client with the wrapping token
            Secret<Dictionary<string, object>> secretIdData =  vaultClientForUnwrapping.V1.System
                .UnwrapWrappedResponseDataAsync<Dictionary<string, object>>(null).Result;

            var secretId = secretIdData.Data["secret_id"]; // Grab the secret_id

            // We create a second VaultClient and initialize it with the AppRole auth method and our new credentials.
            IAuthMethodInfo authMethod = new AppRoleAuthMethodInfo(roleId, secretId.ToString());
            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);

            IVaultClient vaultClient = new VaultClient(vaultClientSettings);

            // We can retrieve the secret from VaultClient
            Secret<SecretData> kv2Secret = null;
            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;

            var password = kv2Secret.Data.Data["password"];

            return password.ToString();
        }
    }
}