Task 1.5: Authenticate to Vault using the API, CLI, and UI

• AAt auth.client_token, sent in the X-Vault-Token header

  Correct

  Login responses carry the token at auth.client_token, and the API accepts it in the X-Vault-Token header or as an Authorization Bearer token.

• BAt data.token, sent in the X-Vault-Token header

  Incorrect

  A login response returns the token in the auth block, not in data.

• CAt auth.accessor, sent as an Authorization Bearer token

  Incorrect

  The accessor is only a reference to a token; it cannot authorize requests.

• DAt auth.client_token, sent as a token query parameter

  Incorrect

  Vault reads the token from the X-Vault-Token or Authorization header, not from a query string.

The login response's auth.client_token is the token, and every later API call sends it in a header.

• Avault login -method=ldap -path=ldap-corp -no-store username=jdoe

  Correct

  -method names the type, -path names where it is enabled, and -no-store prints the token without saving it to the token helper.

• Bvault login -method=ldap-corp -no-store username=jdoe

  Incorrect

  -method takes the auth method type, not the path where it is enabled, so ldap-corp is not a valid method.

• Cvault login -method=ldap -path=ldap-corp -no-print username=jdoe

  Incorrect

  -no-print only hides the token; it is still stored in the token helper.

• Dvault login -path=ldap-corp -no-store username=jdoe

  Incorrect

  Without -method the command uses the token method, which does not take a username.

When an auth method is enabled at a non-default path, -method still names its type and -path names the mount. -no-store keeps the token out of the local token helper, which suits a shared machine.

• Avault auth list

  Incorrect

  This lists the enabled auth methods, not the CLI's current token.

• Bvault login -no-print

  Incorrect

  This starts a new login and hides the resulting token; it does not show the current one.

• Cvault token capabilities

  Incorrect

  This does not print the token value.

• Dvault print token

  Correct

  print token prints the Vault token the CLI currently uses.

vault print has a single subcommand, token, which shows the token the CLI currently uses; treat its output like any other secret.

• AExport the token in the VAULT_ADDR environment variable

  Incorrect

  VAULT_ADDR sets the server address, not the token.

• BExport the token in the VAULT_TOKEN environment variable

  Correct

  The CLI accepts a token from VAULT_TOKEN, as an alternative to vault login.

• CPass the token to vault kv get with -method=token

  Incorrect

  -method belongs to vault login, not to kv commands.

• DExport the token in the VAULT_AGENT_ADDR environment variable

  Incorrect

  That variable points the CLI at a Vault Agent; it does not carry a token.

Unauthenticated users must use vault login or set VAULT_TOKEN before running other commands.

• A-output-curl-string

  Correct

  It prints the command as an equivalent cURL request instead of executing it.

• B-format=json

  Incorrect

  This runs the command and formats the response; it does not show the request.

• C-output-policy

  Incorrect

  This prints a minimal policy that would allow the command, not the HTTP request.

• D-wrap-ttl=1m

  Incorrect

  This wraps the response in a single-use token; the request is still sent and not shown.

Seeing the HTTP request behind a CLI command is a quick way to learn the API path, method and body that a script must send.

• AIn the user's cubbyhole on the Vault server

  Incorrect

  The cubbyhole stores data for a token; it is not where the CLI caches the token.

• BIn the VAULT_TOKEN variable of the current shell

  Incorrect

  The CLI reads VAULT_TOKEN if it is set but does not set it.

• CIn ~/.vault-token, written by the token helper

  Correct

  The token helper caches tokens after vault login; the default file is ~/.vault-token.

• DIn the operating system's keychain by default

  Incorrect

  The default token helper writes a file; a custom helper is needed for other stores.

Deleting ~/.vault-token logs the CLI user out; a custom token helper can store tokens elsewhere.