Support OAuth 2.0 device flow

[DrDaveD]

I suggest that this plugin optionally support the OAuth 2.0 device flow for authentication. This avoids needing to have a callback to a web server on the client's machine and is much easier to manage from the command line.

[DrDaveD]

This would probably be based on this unmerged golang oauth2 pull request or this add-on package.

[kalafut]

Hi. Thanks for the references. Support for Device Flow is definitely of interest, especially for remote login support. It hasn’t been investigated in detail and there isn’t an ETA at this time, but it’s something that will be looked into.

[DrDaveD]

I am beginning to work on a pull request for this.

[kalafut]

Hi @DrDaveD. Can you summarize the approach you plan to take?

[DrDaveD]

Since there's no indication about if or when the unmerged PR I referred to above will get into the golang/oauth2 package, I am instead planning to base my PR on the rjw57/oauth2device code. The latter is basically only a single source file that hasn't changed in 6 years, so I'm thinking I'll either copy it in or just take ideas from it. Because I won't be modifying golang/oauth2, that means I won't be able to use oidc_discovery to find the full URL, so instead I plan to add a role parameter with the full URL of the device authorization endpoint on the token issuer; that's less than ideal but I think not so bad, and maybe in the future can be changed if golang/oauth2 ever gets the device flow support.

I think I will be adding a two-step API then, not a whole lot different than the existing oidc/auth_url plus oidc/callback. In fact maybe the first step of the API can be the same, because device flow still results in a URL that needs to go to the user's web browser. The second step will be different though because it will just be for the client to ask this plugin to poll for the result and continue. The vault login cli of course will also be updated to use the new API when device flow is in use.

How does that sound?

[sidewinder12s]

Was able to work around this by adding this flag when SSHing into a remote machine:

ssh -L 8250:localhost:8250 <address>

And then clicking on the Auth URL when it was presented.

[tsipinakis]

4 years later pinging this issue again as it's a much desired feature for us - it breaks a lot of workflows to not be able to log in easily on SSH (if you forward the port then you can't log in locally).

[DrDaveD]

The port of #131 is now available in an openbao 2.1.0 beta release via openbao/openbao#319.