Add approle metadata to identity alias

[lcgkm]

Could we allows for writing identity token templates that include attribute:[role_name]?
(And including this attribute in path templates)
If Vault can add AppRole's role name to entity alias metadata, and then we can reference Entity metadata in our ACL templates directly.

Reference:
#7985
#2985
#5916

[cfarrend]

We have worked around this by going to the entity associated with the alias after creating the AppRole and using the metadata from there

Then we can apply the policy

path "secret/data/github/deploy-keys/write/{{identity.entity.metadata.repo_name}}" {
  capabilities = ["read"]
}

Not sure if this is related to your issue @lcgkm ?

[lcgkm]

Hi @cfarrend ,
Yes, it is related to my issue. But I don't want to add approle metadata to identity alias manually.
As I know, when we login to Vault using AppRole, the identity and identity alias will be generated automatically.
Please check this: #7985

[cfarrend]

@lcgkm completely agree, we don't want to do it either.

We still need some method of automating this process for the time being as we are pursuing this path for policies that grant access to secrets based on an AppRole name.

The solution we are currently using is as follows:

For new AppRoles (using the CLI):

1. Create the AppRole
2. Get the role_id by using vault read -field=role_id auth/approle/role/<role_name>/role-id
3. Get the secret_id by using vault write -field=secret_id -f auth/approle/role/<role_name>/secret-id
4. Use vault login for the AppRole ID and Secret ID (this step creates the entity - required)
5. Get the entity_id by using vault write -field=id identity/lookup/entity alias_name=<role_id> alias_mount_accessor=<> where alias_mount_accessor is the ID of your AppRole authentication method (from the Auth Methods section in Vault)
6. Write the metadata to the entity by using vault write identity/entity/id/<entity_id>/ metadata=approle_name=<role_name> - you can now use a policy similar to the one described above

For existing AppRoles:
Do steps 5 & 6

[lcgkm]

@cfarrend Agree!
The step 4 is very important. It split the whole provisioning workflow.