- How do I integrate Laravault-Auth with Laravel’s built-in authentication system?
- Laravault-Auth works as a drop-in auth driver. Add `'driver' => 'vault'` to `config/auth.php` under the `users` provider, publish the config with `php artisan vendor:publish`, and ensure your `LoginController` uses `username()` instead of `email()` for Vault-based logins.
- Does Laravault-Auth support Laravel 8 or 9, or is it limited to 5.4?
- While originally built for Laravel 5.4, the package may work with newer versions if dependencies align. Check the `composer.json` for PHP/Laravel constraints, and test thoroughly—some auth system changes (e.g., Guard contracts) may require adjustments.
- What happens if Vault is unavailable during authentication?
- Laravault-Auth doesn’t include built-in fallback logic, but you can extend it via middleware or events. For example, catch `VaultException` and redirect to a maintenance page or local auth. Consider hybrid setups (e.g., Vault + `.env` backup) for critical systems.
- Can I use Laravault-Auth with Laravel Sanctum or Passport for API authentication?
- Yes, but you’ll need to manually bridge the auth flows. Laravault-Auth handles session-based auth; for Sanctum/Passport, use Vault to issue tokens (e.g., JWTs) and validate them via middleware. The package doesn’t natively integrate with these, but you can extend the `AuthenticatesUsers` trait.
- How does token TTL synchronization work, and can I disable it?
- The package automatically ends Laravel sessions when the Vault token expires by comparing session lifetime with the token’s TTL. To disable this, override the `LaravaultAuthServiceProvider` and modify the `extendSessionLifetime` logic, though this may reduce security.
- What Vault authentication methods are supported (e.g., approle, LDAP, AWS IAM)?
- Laravault-Auth primarily relies on Vault’s `approle` auth method, as configured in `config/laravault-auth.php`. For other methods (e.g., LDAP, AWS IAM), you’ll need to extend the `VaultAuthenticator` class or use Vault’s token auth directly, but this requires custom implementation.
- Are there performance considerations for production use, like caching Vault responses?
- Yes, cache Vault responses for non-volatile secrets (e.g., API keys) using Laravel’s `Cache::remember()`. For dynamic secrets (e.g., DB credentials), avoid caching or use short TTLs. The package doesn’t enforce caching, so implement it via middleware or the `VaultClient` service.
- How do I test Laravault-Auth in a CI/CD pipeline where Vault isn’t available?
- Mock the Vault client using Laravel’s `Mockery` or `VaultMock` (if available). Override the `VaultClient` binding in your test `ServiceProvider` to return fake responses. Test edge cases like token expiry and failed requests separately.
- What’s the best way to monitor Vault token usage or errors in production?
- Log Vault API calls and errors via Laravel’s logging system (e.g., `Log::error($e->getMessage())`). For advanced monitoring, integrate with tools like Prometheus (via Vault’s metrics endpoint) or ELK Stack. The package doesn’t include built-in monitoring, so extend it via events or middleware.
- Are there alternatives to Laravault-Auth for Laravel + Vault integration?
- For Vault-backed auth, consider `spatie/laravel-vault` (for secrets management) or `tighten/ziggy` (for dynamic secrets). For full auth providers, you might need to build a custom solution using the `hashicorp/vault-php` SDK directly. Laravault-Auth is unique in its session-TTL sync feature.