added VAULT_USER; default is sfeng; fix 0.10.x vault login crash issue.

#!/bin/bash

# Adopted from https://gitlab.med.stanford.edu/irt-public/gcloud-scripts/blob/master/vault-login.sh

###############################################################################

# login to vault

###############################################################################

THIS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

THIS_DIR=$(dirname "$0")

# include functions

source $THIS_DIR/utils/functions.sh

set +u # optional vars

export VAULT_ADDR=${VAULT_ADDR:-https://vault.stanford.edu}

export VAULT_SEC_PATH=${VAULT_SEC_PATH:-auth/token/lookup-self}

export SEC_PATH=${SEC_PATH:-auth/token/lookup-self}

export VAULT_AUTH_PATH=${VAULT_AUTH_PATH:-ldap}

export VAULT_AUTH_METHOD=${VAULT_AUTH_METHOD:-ldap}

export VAULT_USER=${VAULT_USER:-$USER}

export VAULT_ROLE_ID=${VAULT_ROLE_ID}

export VAULT_USER=${LOGNAME:-$USER}

export VAULT_SECRET_ID=${VAULT_SECRET_ID}

export VAULT_APPROLE_LOGIN_TOKEN=${VAULT_APPROLE_LOGIN_TOKEN}

set -u

echo "VAULT ADDR: $VAULT_ADDR"

echo "VAULT SERVER: $VAULT_ADDR"

if ! [ -z $VAULT_ROLE_ID ]; then

    echo "attempting to login in w/ approle provided in env vars VAULT_ROLE_ID & VAULT_SECRET_ID"

    export VAULT_TOKEN=$VAULT_APPROLE_LOGIN_TOKEN

    if ! vault write -format json auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID 2>&1; then

        >&2 "ERROR: unable to login with VAULT_ROLE_ID & VAULT_SECRET_ID" && false

    else

        vault write -format json auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID | jq -er .auth.client_token > ~/.vault-token

        unset VAULT_TOKEN

    fi

    vault write -format json auth/approle/login \

        role_id=$VAULT_ROLE_ID \

        secret_id=$VAULT_SECRET_ID \

        | jq -er .auth.client_token > ~/.vault-token

fi

if ! vault token lookup > /dev/null 2>&1; then

        >&2 "ERROR: VAULT_TOKEN does not exist or is not valid" && false

    fi

    echo "Hey $VAULT_USER: Please login VAULT with DUO device ready. Waiting...:"

    vault login -method=${VAULT_AUTH_METHOD} -path=${VAULT_AUTH_PATH}

    echo "Please login VAULT as vault user ${VAULT_USER} with DUO device ready:"

    vault login -method=${VAULT_AUTH_METHOD} -path=${VAULT_AUTH_PATH} username=${VAULT_USER}

fi

# Warning if using root token

if vault token capabilities ${VAULT_SEC_PATH}/* | grep -q root; then

    echo "You are logged in VAULT with root token!"

    exit 0

fi

sec_path='auth/token/lookup-self'

if [ ${VAULT_SEC_PATH} != $sec_path ]; then

     sec_path="${VAULT_SEC_PATH}/*"

fi

if vault token capabilities $sec_path | grep -q read; then

    echo "You are logged in VAULT and have permission to read from ${VAULT_SEC_PATH}/*"

if vault token capabilities ${SEC_PATH}/* | grep  -E -q "read|root"; then

    echo "You are logged in VAULT and have permission to read from ${SEC_PATH}/*"

else

    if ! [ -z $VAULT_ROLE_ID ]; then

        >&2 "ERROR: no permission to read from ${VAULT_SEC_PATH}/*" && false

        >&2 "ERROR: no permission to read from ${SEC_PATH}/*" && false

    fi

    echo "Permission denied to read from ${VAULT_SEC_PATH}/*, please login again:"

    vault login -method=${VAULT_AUTH_METHOD} -path=${VAULT_AUTH_PATH}

    echo "Permission denied to read from ${SEC_PATH}/*, please login again as vault user ${VAULT_USER}:"

    vault login -method=${VAULT_AUTH_METHOD} -path=${VAULT_AUTH_PATH} username=${VAULT_USER}

fi