Prepare revocation of ephemeral tokens

If the plugin logs into Vault in the process of executing a task beyond
just logging in (i.e. not in e.g. the token_create lookup), the tokens
should be revoked at the end of the action to prevent them from leaking.

In order to support that, the authentication method needs to tell us
whether it created a fresh token (which we should revoke) or whether it
used a token provided by the caller (which we should not revoke).

plugins/module_utils/_auth_method_approle.py

@@ -38,3 +38,6 @@ def authenticate(self, client, use_token=True):
             response = client.auth_approle(use_token=use_token, **params)
 
         return response
+
+    def should_revoke_token(self):
+        return True

plugins/module_utils/_auth_method_aws_iam.py

@@ -95,3 +95,6 @@ def authenticate(self, client, use_token=True):
             client.auth_aws_iam(use_token=use_token, **params)
 
         return response
+
+    def should_revoke_token(self):
+        return True

plugins/module_utils/_auth_method_jwt.py

@@ -49,3 +49,6 @@ def authenticate(self, client, use_token=True):
             client.token = response['auth']['client_token']
 
         return response
+
+    def should_revoke_token(self):
+        return True

plugins/module_utils/_auth_method_ldap.py

@@ -38,3 +38,6 @@ def authenticate(self, client, use_token=True):
             response = client.auth_ldap(use_token=use_token, **params)
 
         return response
+
+    def should_revoke_token(self):
+        return True

plugins/module_utils/_auth_method_none.py

@@ -31,3 +31,6 @@ def validate(self):
 
     def authenticate(self, client, use_token=False):
         return None
+
+    def should_revoke_token(self):
+        return False

plugins/module_utils/_auth_method_token.py

@@ -111,3 +111,6 @@ def authenticate(self, client, use_token=True, lookup_self=False):
                         raise HashiVaultValueError("Invalid Vault Token Specified.")
 
         return self._simulate_login_response(token, response)
+
+    def should_revoke_token(self):
+        return False

plugins/module_utils/_auth_method_userpass.py

@@ -45,3 +45,6 @@ def authenticate(self, client, use_token=True):
             client.token = response['auth']['client_token']
 
         return response
+
+    def should_revoke_token(self):
+        return True

plugins/module_utils/_authenticator.py

@@ -94,3 +94,10 @@ def validate(self, *args, **kwargs):
     def authenticate(self, *args, **kwargs):
         method = self._get_method_object(kwargs.pop('method', None))
         return method.authenticate(*args, **kwargs)
+
+    def should_revoke_token(self, **kwargs):
+        method = self._get_method_object(kwargs.pop('method', None))
+        return method.should_revoke_token(**kwargs)
+
+    def logout(self, client, **kwargs):
+        client.logout(revoke_token=self.should_revoke_token(**kwargs))

plugins/module_utils/_hashi_vault_common.py

@@ -249,3 +249,6 @@ def warn(self, message):
 
     def deprecate(self, message, version=None, date=None, collection_name=None):
         self._deprecator(message, version=version, date=date, collection_name=collection_name)
+
+    def should_revoke_token(self, **kwargs):
+        return False