OpenBao Token Helper with keyutils

By default, the bao login command stores the token it obtained in a plain text file at ~/.vault-token. It's interesting that a tool like OpenBao, which is specifically built for properly handling secrets, takes such a naïve approach to storing its own client credentials.

Fortunately, it does support Token Helpers, although it doesn't come with any out of the box. The API is simple enough, though, that a shell script can implement it.

I've written this token helper to store the token in the Linux kernel keyring:

#!/bin/sh

if [ -n "${VAULT_ADDR}" ]; then
    keyname=$(echo "${VAULT_ADDR}" | b2sum | head -c 8)
else
    keyname=default
fi

case $1 in
get)
    keyctl pipe %user:openbao:${keyname} || :
    ;;
store)
    keyctl padd user openbao:${keyname} @u
    ;;
erase)
    keyctl revoke %user:openbao:${keyname}
    ;;
esac

To use it, set the token_helper setting in ~/.bao

token_helper = "/home/dustin/.local/libexec/bao-token-helper"