initial new app-role auth backend

src/VaultSharp/Backends/Authentication/Models/AppRole/AppRoleAuthenticationInfo.cs

@@ -0,0 +1,124 @@
+using VaultSharp.Infrastructure.Validation;
+
+namespace VaultSharp.Backends.Authentication.Models.AppRole
+{
+    /// <summary>
+    /// Represents the login information for the AppRole Authentication backend.
+    /// </summary>
+    public class AppRoleAuthenticationInfo : IAuthenticationInfo
+    {
+        /// <summary>
+        /// Gets the type of the authentication backend.
+        /// </summary>
+        /// <value>
+        /// The type of the authentication backend.
+        /// </value>
+        public AuthenticationBackendType AuthenticationBackendType
+        {
+            get
+            {
+                return AuthenticationBackendType.AppRole;
+            }
+        }
+
+        /// <summary>
+        /// Gets the mount point.
+        /// Presence or absence of leading or trailing slashes don't matter.
+        /// </summary>
+        /// <value>
+        /// The mount point.
+        /// </value>
+        public string MountPoint { get; }
+
+        /// <summary>
+        /// Gets the role identifier.
+        /// RoleID is an identifier that selects the AppRole against which the other credentials are evaluated. 
+        /// When authenticating against this backend's login endpoint, the RoleID is a required argument 
+        /// at all times. By default, RoleIDs are unique UUIDs, which allow them to serve as secondary 
+        /// secrets to the other credential information. 
+        /// However, they can be set to particular values to match introspected information by the 
+        /// client (for instance, the client's domain name).
+        /// </summary>
+        /// <value>
+        /// The role identifier.
+        /// </value>
+        public string RoleId { get; }
+
+        /// <summary>
+        /// Gets the secret identifier.
+        /// SecretID is a credential that is required by default for any login and is intended to always be secret.
+        /// (For advanced usage, requiring a SecretID can be disabled via an AppRole's bind_secret_id parameter, 
+        /// allowing machines with only knowledge of the RoleID, or matching other set constraints, 
+        /// to fetch a token). 
+        /// SecretIDs can be created against an AppRole either via generation of a 
+        /// 128-bit purely random UUID by the role itself (Pull mode) or via specific, 
+        /// custom values (Push mode). Similarly to tokens, SecretIDs have properties like usage-limit, 
+        /// TTLs and expirations.
+        /// </summary>
+        /// <value>
+        /// The secret identifier.
+        /// </value>
+        public string SecretId { get; }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="AppRoleAuthenticationInfo"/> class.
+        /// </summary>
+        /// <param name="roleId">
+        /// The role identifier.
+        /// RoleID is an identifier that selects the AppRole against which the other credentials are evaluated. 
+        /// When authenticating against this backend's login endpoint, the RoleID is a required argument 
+        /// at all times. By default, RoleIDs are unique UUIDs, which allow them to serve as secondary 
+        /// secrets to the other credential information. 
+        /// However, they can be set to particular values to match introspected information by the 
+        /// client (for instance, the client's domain name).
+        /// </param>
+        /// <param name="secretId">
+        /// The secret identifier.
+        /// SecretID is a credential that is required by default for any login and is intended to always be secret.
+        /// (For advanced usage, requiring a SecretID can be disabled via an AppRole's bind_secret_id parameter, 
+        /// allowing machines with only knowledge of the RoleID, or matching other set constraints, 
+        /// to fetch a token). 
+        /// SecretIDs can be created against an AppRole either via generation of a 
+        /// 128-bit purely random UUID by the role itself (Pull mode) or via specific, 
+        /// custom values (Push mode). Similarly to tokens, SecretIDs have properties like usage-limit, 
+        /// TTLs and expirations.
+        /// </param>
+        public AppRoleAuthenticationInfo(string roleId, string secretId = null) : this(AuthenticationBackendType.AppRole.Type, roleId, secretId)
+        {
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="AppRoleAuthenticationInfo"/> class.
+        /// </summary>
+        /// <param name="mountPoint">The mount point.</param>
+        /// <param name="roleId">
+        /// The role identifier.
+        /// RoleID is an identifier that selects the AppRole against which the other credentials are evaluated. 
+        /// When authenticating against this backend's login endpoint, the RoleID is a required argument 
+        /// at all times. By default, RoleIDs are unique UUIDs, which allow them to serve as secondary 
+        /// secrets to the other credential information. 
+        /// However, they can be set to particular values to match introspected information by the 
+        /// client (for instance, the client's domain name).
+        /// </param>
+        /// <param name="secretId">
+        /// The secret identifier.
+        /// SecretID is a credential that is required by default for any login and is intended to always be secret.
+        /// (For advanced usage, requiring a SecretID can be disabled via an AppRole's bind_secret_id parameter, 
+        /// allowing machines with only knowledge of the RoleID, or matching other set constraints, 
+        /// to fetch a token). 
+        /// SecretIDs can be created against an AppRole either via generation of a 
+        /// 128-bit purely random UUID by the role itself (Pull mode) or via specific, 
+        /// custom values (Push mode). Similarly to tokens, SecretIDs have properties like usage-limit, 
+        /// TTLs and expirations.
+        /// </param>
+        public AppRoleAuthenticationInfo(string mountPoint, string roleId, string secretId = null)
+        {
+            Checker.NotNull(mountPoint, "mountPoint");
+            Checker.NotNull(roleId, "roleId");
+
+            MountPoint = mountPoint;
+            RoleId = roleId;
+            SecretId = secretId;
+        }
+    }
+}

src/VaultSharp/Backends/Authentication/Models/AuthenticationBackendType.cs

@@ -16,6 +16,11 @@ public class AuthenticationBackendType : IEquatable<AuthenticationBackendType>
         /// </summary>
         private static readonly AuthenticationBackendType AppIdType = new AuthenticationBackendType("app-id");
 
+        /// <summary>
+        /// The application role type
+        /// </summary>
+        private static readonly AuthenticationBackendType AppRoleType = new AuthenticationBackendType("approle");
+
         /// <summary>
         /// The git hub type
         /// </summary>
@@ -64,6 +69,20 @@ public static AuthenticationBackendType AppId
             }
         }
 
+        /// <summary>
+        /// Gets the application role.
+        /// </summary>
+        /// <value>
+        /// The application role.
+        /// </value>
+        public static AuthenticationBackendType AppRole
+        {
+            get
+            {
+                return AppRoleType;
+            }
+        }
+
         /// <summary>
         /// Gets the git hub type.
         /// </summary>

src/VaultSharp/Backends/Authentication/Providers/AppRole/AppRoleAuthenticationProvider.cs

@@ -0,0 +1,55 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Net.Http;
+using System.Threading.Tasks;
+using VaultSharp.Backends.Authentication.Models.AppRole;
+using VaultSharp.Backends.System.Models;
+using VaultSharp.DataAccess;
+
+namespace VaultSharp.Backends.Authentication.Providers.AppRole
+{
+    internal class AppRoleAuthenticationProvider : IAuthenticationProvider
+    {
+        private readonly AppRoleAuthenticationInfo _appRoleAuthenticationInfo;
+        private readonly IDataAccessManager _dataAccessManager;
+        private readonly bool _continueAsyncTasksOnCapturedContext;
+
+        public AppRoleAuthenticationProvider(AppRoleAuthenticationInfo appRoleAuthenticationInfo, IDataAccessManager dataAccessManager, bool continueAsyncTasksOnCapturedContext = false)
+        {
+            _appRoleAuthenticationInfo = appRoleAuthenticationInfo;
+            _dataAccessManager = dataAccessManager;
+            _continueAsyncTasksOnCapturedContext = continueAsyncTasksOnCapturedContext;
+        }
+
+        public async Task<string> GetTokenAsync()
+        {
+            var requestData = new
+            {
+                role_id = _appRoleAuthenticationInfo.RoleId,
+                secret_id = _appRoleAuthenticationInfo.SecretId
+            };
+
+            var response =
+                await
+                    _dataAccessManager.MakeRequestAsync<Secret<Dictionary<string, object>>>(LoginResourcePath,
+                        HttpMethod.Post, requestData).ConfigureAwait(_continueAsyncTasksOnCapturedContext);
+
+            if (response != null && response.AuthorizationInfo != null && !string.IsNullOrWhiteSpace(response.AuthorizationInfo.ClientToken))
+            {
+                return response.AuthorizationInfo.ClientToken;
+            }
+
+            throw new Exception("The call to the authentication backend did not yield a client token. Please verify your credentials.");
+        }
+
+        private string LoginResourcePath
+        {
+            get
+            {
+                var endpoint = string.Format(CultureInfo.InvariantCulture, "auth/{0}/login", _appRoleAuthenticationInfo.MountPoint.Trim('/'));
+                return endpoint;
+            }
+        }
+    }
+}

src/VaultSharp/Backends/Authentication/Providers/AuthenticationProviderFactory.cs

@@ -2,13 +2,15 @@
 using System.Net.Http;
 using VaultSharp.Backends.Authentication.Models;
 using VaultSharp.Backends.Authentication.Models.AppId;
+using VaultSharp.Backends.Authentication.Models.AppRole;
 using VaultSharp.Backends.Authentication.Models.Certificate;
 using VaultSharp.Backends.Authentication.Models.Custom;
 using VaultSharp.Backends.Authentication.Models.GitHub;
 using VaultSharp.Backends.Authentication.Models.LDAP;
 using VaultSharp.Backends.Authentication.Models.Token;
 using VaultSharp.Backends.Authentication.Models.UsernamePassword;
 using VaultSharp.Backends.Authentication.Providers.AppId;
+using VaultSharp.Backends.Authentication.Providers.AppRole;
 using VaultSharp.Backends.Authentication.Providers.Certificate;
 using VaultSharp.Backends.Authentication.Providers.Custom;
 using VaultSharp.Backends.Authentication.Providers.GitHub;
@@ -28,6 +30,11 @@ public static IAuthenticationProvider CreateAuthenticationProvider(IAuthenticati
                 return new AppIdAuthenticationProvider(authenticationInfo as AppIdAuthenticationInfo, new HttpDataAccessManager(baseAddress, serviceTimeout: serviceTimeout), continueAsyncTasksOnCapturedContext);
             }
 
+            if (authenticationInfo.AuthenticationBackendType == AuthenticationBackendType.AppRole)
+            {
+                return new AppRoleAuthenticationProvider(authenticationInfo as AppRoleAuthenticationInfo, new HttpDataAccessManager(baseAddress, serviceTimeout: serviceTimeout), continueAsyncTasksOnCapturedContext);
+            }
+
             if (authenticationInfo.AuthenticationBackendType == AuthenticationBackendType.GitHub)
             {
                 return new GitHubAuthenticationProvider(authenticationInfo as GitHubAuthenticationInfo, new HttpDataAccessManager(baseAddress, serviceTimeout: serviceTimeout), continueAsyncTasksOnCapturedContext);

src/VaultSharp/Backends/System/Models/AuthorizationInfo.cs

@@ -8,6 +8,15 @@ namespace VaultSharp.Backends.System.Models
     /// </summary>
     public class AuthorizationInfo
     {
+        /// <summary>
+        /// Gets or sets the client token accessor.
+        /// </summary>
+        /// <value>
+        /// The client token accessor.
+        /// </value>
+        [JsonProperty("accessor")]
+        public string ClientTokenAccessor { get; set; }
+
         /// <summary>
         /// Gets or sets the client token.
         /// </summary>

src/VaultSharp/VaultSharp.csproj

@@ -52,8 +52,10 @@
   </ItemGroup>
   <ItemGroup>
     <Compile Include="Backends\Audit\Models\AuditBackendType.cs" />
+    <Compile Include="Backends\Authentication\Models\AppRole\AppRoleAuthenticationInfo.cs" />
     <Compile Include="Backends\Authentication\Models\AuthenticationBackendType.cs" />
     <Compile Include="Backends\Authentication\Models\Token\TokenCreationOptions.cs" />
+    <Compile Include="Backends\Authentication\Providers\AppRole\AppRoleAuthenticationProvider.cs" />
     <Compile Include="Backends\Secret\Models\AWS\AWSRoleDefinition.cs" />
     <Compile Include="Backends\Secret\Models\AWS\AWSRootCredentials.cs" />
     <Compile Include="Backends\Secret\Models\Cassandra\CassandraConnectionInfo.cs" />
@@ -166,6 +168,7 @@
   <ItemGroup>
     <None Include="packages.config" />
   </ItemGroup>
+  <ItemGroup />
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.