Vault: Feature Request: Logout function for CLI

[jcrowthe]

On the CLI, upon successfully running vault auth, the token is stored at ~/.vault-token. I assume this is to allow multiple terminal sessions to access vault after one login. It would make more sense to dump the token to the VAULT_TOKEN environment variable noted in the docs, but I can see some not liking this idea.

Instead, this request is for a vault logout function to be added to the cli. Very simply, this would effectively run rm ~/.vault-token.

I have mentioned these two related items here in order for others to understand the context. Either solution would function, and I would like to start a conversation regarding the two.

[jefferai]

You're correct about your assumption. It's also a pluggable mechanism; an external binary can be used so that in theory it can e.g. integrate with your system keychain via envchain or some such thing.

We're not going to add a vault logout command at this time however. As you noted it would be functionally equivalent to a simple rm and we already have enough commands that people very often get confuzzled.

[jefferai]

Note that there are now token-only and no-store flags on the CLI, either of which will cause the token to not be stored.

[TerraTech]

What I've been doing is: _$ vault token revoke -self_
seems to work well for intended purpose.

[a-nldisr]

Advice: Do not use _vault token revoke -self_ when you are using the root token or if you have a token that has a lot of children. Because this revokes all tokens generated by this token and the tokens they created. So use instead
_vault token revoke -mode=orphan -self_

[jefferai]

Please note that @a-nldisr 's comment above is not considered canonical advice. Revoking in orphan mode has real security implications that should be understood before using it.