Support Vault as credential provider

README.md

@@ -14,6 +14,7 @@ This library provides a unified interface for obtaining and refreshing credentia
 - **K8sSecret:** Watches a Kubernetes secret which contains a token and publishes updates when the secret changes
 - **OAuth2AC:** Obtains access tokens through OAuth2 authorization code flow and refreshes them before expiration
 - **OAuth2CC:** Obtains access tokens through OAuth2 client credentials flow and refreshes them before expiration
+- **Vault** Exchanges ID tokens for secrets from Vault using Vault's JWT authentication.
 
 ## Installation
 
@@ -647,6 +648,75 @@ go func() {
 // wg.Wait()
 ```
 
+
+### Vault Credentials Provider
+
+```go
+import (
+    "go.riptides.io/tokenex/pkg/credential"
+    "go.riptides.io/tokenex/pkg/token"
+    "go.riptides.io/tokenex/pkg/vault"
+)
+
+
+// Create a logger
+logger := logr.New(logr.Discard())
+
+// Create the Vault credentials provider
+vaultProvider, err := vault.NewCredentialsProvider(ctx, logger, "http://localhost:8200")
+if err != nil {
+	return err
+}
+
+// Get credentials from Vault
+dbCredsChan, err := vaultProvider.GetCredentials(
+		ctx,
+		idTokenProvider,
+		vault.WithJWTAuthMethodPath("jwt"),
+		vault.WithJWTAuthRoleName("dbuser"),
+		vault.WithSecretFullPath("database/creds/pg-dyn-dbuser"),
+	)
+	if err != nil {
+		return err
+	}
+
+// Process dynamic credentials from the channel in a goroutine with proper context handling
+wg.Add(1)
+go func() {
+    defer wg.Done()
+    for {
+        select {
+        case creds, ok := <-dbCredsChan:
+            if !ok {
+                logger.Info("Database credentials channel closed")
+                return
+            }
+            if creds.Err != nil {
+                logger.Error(creds.Err, "Error receiving database credentials", errors.GetDetails(creds.Err))
+                return
+            }
+
+            dbSecret := creds.Credential.(*credential.VaultSecret)
+
+            // Database secrets typically contain username and password
+            if username, ok := dbSecret.Data["username"].(string); ok {
+                logger.Info("Database username", "value", username)
+            }
+            if password, ok := dbSecret.Data["password"].(string); ok {
+                logger.Info("Database password", "value", password)
+            }
+
+        case <-ctx.Done():
+            log.Println("Context cancelled, shutting down database credentials handler")
+            return
+        }
+    }
+}()
+
+// In a real application, you would wait for all goroutines to complete before exiting
+// wg.Wait()
+```
+
 ## Channel Behavior
 
 All credential providers in this library follow a consistent pattern for credential delivery:

go.mod

@@ -1,6 +1,8 @@
 module go.riptides.io/tokenex
 
-go 1.24.3
+go 1.24.4
+
+toolchain go1.24.6
 
 require (
 	cloud.google.com/go/iam v1.5.2
@@ -13,6 +15,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.34.0
 	github.com/go-logr/logr v1.4.3
 	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/openbao/openbao/api/auth/jwt/v2 v2.5.0
+	github.com/openbao/openbao/api/v2 v2.5.0
 	github.com/werbenhu/eventbus v1.0.8
 	golang.org/x/oauth2 v0.30.0
 	google.golang.org/api v0.240.0
@@ -37,32 +41,44 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
 	github.com/aws/smithy-go v1.22.4 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
@@ -71,13 +87,13 @@ require (
 	go.opentelemetry.io/otel/metric v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/grpc v1.73.0 // indirect