"Missing client token" when authenticating with login/pass on Hashicorp Vault

Question

I'm trying to get login/pass authentication working on Vault. When I try the method given in the API documentation here: https://www.vaultproject.io/api/auth/userpass/index.html#login

I get this error:

$ curl --request POST --data @payload.json https://<myurl>:8200/v1/auth/userpass/login/<mylogin> -k
{"errors":["missing client token"]}

And I can't find information on this error. It makes me wonder what happens, because I want to authenticate with login/pass to get the token, so that's just normal to not have it.

Here is the content of the payload.json:

{
  "password": "foo"
}

Is there any way to login with username/password? This is the only fallback method I have when the user does not know its token.

Thanks!

Answer 1

OK, so I figured it out by trials.

So the userpass AUTH was indeed disabled. I have to use LDAP auth. With the Vault-UI that is installed, I managed to find the URL to authenticate. If was the following : https://******:8200/v1/auth/<ldap>/login/<user>

And that way it's working.

Unfortunately, it does not help in the end. The idea was to synchronize Vault data locally, but the Vault API is really not built for that kind of access. It requires a LOT of requests, and end up being very slow for a few secrets synchronized.

Answer 2

Make sure you are logging in under the correct namespace. You will get this error if your authentication method is enabled under something other than the default namespace that your CLI tool is using.

You can specify the namespace with the -ns=my/namespace/ parameter or the VAULT_NAMESPACE environment variable.

For example, if your namespace is "desserts/icecream"

vault login -ns=desserts/icecream/ -method=userpass username=ian

# OR

export VAULT_NAMESPACE=desserts/icecream/
vault login -method=userpass username=ian