Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method. An ephemeral token is used to obtain a second, login VaultToken from Vault's Cubbyhole secret backend. The login token is usually longer-lived and used to interact with Vault. The login token can be retrieved either from a wrapped response or from the data section.

Wrapped token response usage

 
 $ vault token-create -wrap-ttl="10m"
 Key                            Value
 ---                            -----
 wrapping_token:                397ccb93-ff6c-b17b-9389-380b01ca2645
 wrapping_token_ttl:            0h10m0s
 wrapping_token_creation_time:  2016-09-18 20:29:48.652957077 +0200 CEST
 wrapped_accessor:              46b6aebb-187f-932a-26d7-4f3d86a68319
 
 

 
 CubbyholeAuthenticationOptions options = CubbyholeAuthenticationOptions
                .builder()
                .initialToken(VaultToken.of("397ccb93-ff6c-b17b-9389-380b01ca2645"))
                .wrapped()
                .build();
 CubbyholeAuthentication authentication = new CubbyholeAuthentication(options, vaultClient);
 
 

Stored token response usage

 
 $ vault token-create
 Key                    Value
 ---                    -----
 token                  f9e30681-d46a-cdaf-aaa0-2ae0a9ad0819
 token_accessor         4eee9bd9-81bb-06d6-af01-723c54a72148
 token_duration         0s
 token_renewable        false
 token_policies         [root]

 $ token-create -use-limit=2 -orphan -no-default-policy -policy=none
 Key                    Value
 ---                    -----
 token                  895cb88b-aef4-0e33-ba65-d50007290780
 token_accessor         e84b661c-8aa8-2286-b788-f258f30c8325
 token_duration         0s
 token_renewable        false
 token_policies         [none]

 $ export VAULT_TOKEN=895cb88b-aef4-0e33-ba65-d50007290780
 $ vault write cubbyhole/token token=f9e30681-d46a-cdaf-aaa0-2ae0a9ad0819
 
 

 
 CubbyholeAuthenticationOptions options = CubbyholeAuthenticationOptions
                .builder()
                .initialToken(VaultToken.of("895cb88b-aef4-0e33-ba65-d50007290780"))
                .path("cubbyhole/token")
                .build();
 CubbyholeAuthentication authentication = new CubbyholeAuthentication(options, vaultClient);