我可以在 Hashicorp Vault 上创建一个策略以允许令牌所有者仅读取他们自己的秘密吗？

Question

I'm using Vault from it's official Docker (latest) image and KVv2 as the secrets engine.

I want to prevent token holders from reading secrets that are not owned by themselves.

Firstly, I've created a templating policy called "acl-caging-policy" to control requests under /secret/data/[username] . Tried both with and without the trailing /*.

$ http http://127.0.0.1:8200/v1/sys/policy/acl-caging-policy policy:='"path \"secret/data/{{identity.entity.metadata.user}}\" {capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]}"' X-VAULT-TOKEN:"[ROOT_TOKEN]"

Vault is successfully showing it for me:

$ docker exec -it vault-app vault policy read acl-caging-policy
path "secret/data/{{identity.entity.metadata.user}}" { capabilities = ["create", "read", "update", "delete", "list"]}

Then, I created a token for an user:

$ http http://127.0.0.1:8200/v1/auth/token/create policies:='["acl-caging-policy"]'  meta:='{"user": "oystr"}' ttl="999999h" renewable:=false X-VAULT-TOKEN:"[ROOT_TOKEN]"

Which Vault creates successfully:

$ docker exec -it vault-app vault token lookup [USER_TOKEN]                                                                                                          
Key                 Value
---                 -----
accessor            [USER_ACCESSOR]
creation_time       1585935126
creation_ttl        999999h
display_name        token
entity_id           n/a
expire_time         2134-05-03T08:32:06.496766579Z
explicit_max_ttl    0s
id                  [USER_TOKEN] 
issue_time          2020-04-03T17:32:06.496771065Z
meta                map[user:oystr]
num_uses            0
orphan              false
path                auth/token/create
policies            [acl-caging-policy default]
renewable           false
ttl                 999997h53m46s
type                service

But whenever I try to store any information:

$ http http://127.0.0.1:8200/v1/secret/data/oystr data:='{"username": "oystr", "password": "[PASSWORD]"}' X-VAULT-TOKEN:"[USER_TOKEN]"
HTTP/1.1 403 Forbidden
Cache-Control: no-store
Content-Length: 60
Content-Type: application/json
Date: Fri, 03 Apr 2020 18:23:25 GMT

{
    "errors": [
        "1 error occurred:\n\t* permission denied\n\n"
    ]
}

Is it possible or am I missing something here?

Answer 1

The problem is that you need an Entity for templating to work. When you just create a token, there is no Entity associated with it. Instead, create an Entity for each of your users, which can have an Alias set up for whatever authentication method you use (or will use), and then when a user logs in, their token will be associated with their Entity. At this point the templating should work, though you probably want to change it to use something like {{identity.entity.name}} instead of metadata . If you want to use metadata , you'll need to set up that metadata on the Entities that you create.