Add Okta auth method

[dylan-azucena]

Add functionality from here: https://www.vaultproject.io/docs/auth/okta.html to authenticate with Okta. Includes unit test (I believe integration tests would require an Okta account).

[hashicorp-cla]

All committers have signed the CLA.

[robkinyon-roivant]

The problem with that PR is the same as problem #197 raises. You cannot assume okta is the correct path. We have multiple Okta backends, each with their own path. We already have to monkey-patch the LDAP authentication method to support non-standard paths.

[dylan-azucena]

@robkinyon-roivant I believe what you're looking for is to pass the mount point via the custom options hash when using the auth method. Here's an example using the userpass auth method:

vault-ruby/spec/integration/api/auth_spec.rb

Line 147 in e53f8ec

result = subject.auth.userpass(@username, @password, mount: "new-userpass")

Have you tried this way of specifying the mount point with LDAP auth?

[robkinyon-roivant]

@robkinyon-roivant I believe what you're looking for is to pass the mount point via the custom options hash when using the auth method. Here's an example using the userpass auth method:

vault-ruby/spec/integration/api/auth_spec.rb

Line 147 in e53f8ec

result = subject.auth.userpass(@username, @password, mount: "new-userpass")

Have you tried this way of specifying the mount point with LDAP auth?

I have. The code doesn't look at options[:mount]. None of the code does, even the methods whose documentation says to use a custom mount-point, like userpass().

The broken line is

vault-ruby/lib/vault/api/auth.rb

Line 142 in e53f8ec

json = client.post("/v1/auth/ldap/login/#{encode_path(username)}", JSON.fast_generate(payload))

Instead, that line (in ldap()) should be something like:

      mount = options[:mount] || 'ldap'
      json = client.post("/v1/auth/#{mount}/login/#{encode_path(username)}", JSON.fast_generate(payload))

And then (with appropriate default) in okta(), userpass(), etc.

The mistake in the auth specs is that the userpass and new-userpass mounts both return the same thing. There's no way to differentiate between them, so you don't know that options[:mount] is being ignored. Instead, you should verify that mount: not-a-thing returns unauthenticated like on

vault-ruby/spec/integration/api/auth_spec.rb

Line 151 in e53f8ec

it "raises an error if the authentication is bad" do

.