Vault: OAuth2 token refreshing as a secret backend

[andris9]

To make an OAuth2 request we need an access token. Access token has a TTL, so once it is expired we need to get a new one using a refresh token. Instead of refreshing the access tokens directly it would be better if Vault would do it. This way the app itself does not need to know anything about the Oauth2 refresh tokens, application ids or application secrets, it could just fetch an access token from Vault and not care about the details. If the app can only access the expiring access token, then it would be also a lot securer than knowing also the non-expiring refresh token.

[kunickiaj]

Any idea on the status of this request?

[jefferai]

We have no current plans for a built-in backend to do this, but with our plugin capabilities this can now be easily created by an interested third-party!

[impl]

If anyone happens to stumble across this issue looking for a solution, we implemented this as a plugin: https://github.com/puppetlabs/vault-plugin-secrets-oauthapp

Feel free to give it a try and you're welcome to file GitHub issues if you run into any problems!