Add ability to log in with specific policies

[mikenomitch]

Hi from the Nomad team 👋

Context

Nomad is enabling logging into Vault using JWT auth. Our current setup involves creating a JWT Role that maps to a Policy and then Nomad admins can set a default role on each cluster and jobspec authors can override the default role.

This should generally work and with templated policies, most new users should be able to create pretty simple setups assuming they structure their secrets in an idiomatic way.

Unfortunately, existing users are used to passing in a "policy" value into their Nomad jobspec that then gets threaded thru to a token creation call for that specific policy. (This relies on Nomad having a very powerful and long lived token, so we'd like to get rid of this option for a variety of reasons) - Existing Nomad users might have a bunch of one-off Vault Policies created for each Nomad job, and we'd like to give them some reasonable way to point to these policies from Nomad with JWT Auth. Right now they would have to go and create a role for each policy and then log in with that, which isn't an ideal experience.

Proposals

I was wondering if one of two options is possible. I haven't thought through either in depth:

1. Add some sort of "allowed_policies" value to each role, and then add a "policy" value to the "login" call. You could specify a role and one of the policies allowed. Maybe the "allowed_policies" could allow wildcarding so you wouldn't have to update the role for each new policy?
2. Add some way of interpolating JWT attributes into policy names. I think this is what we'll end up doing in Consul using a BindingRule (PR: [NET-6640] Adds "Policy" BindType to BindingRule consul#19499) (Binding Rule docs: https://developer.hashicorp.com/consul/api-docs/acl/binding-rules). So my role could allow access to policy "nomad-${identity.metadata.jobname}" or something like that.

Thoughts on either option? Is there some other way to achieve this that currently exists? Being able to specify a policy in a JWT and get it without creating a new role for it. FWIW, I think the second option is the preferable option both for Nomad & Vault.

[mikenomitch]

I was thinking about this over the weekend, and realized that maybe taking multiple policies would be good, not just one! Probably very similarly implemented, but just noting that people can pass in multiple now, so might be good to support that.