delegate BasicAuth to a Vault instance (ngx_http_auth_request_module)

flask-auth_request-proxy.py

import os
import hvac
import json

from flask import Flask, request, make_response

app = Flask(__name__, template_folder='templates')
app.config['SECRET_KEY'] = 'https:/your.vault.instance:8200/'
app.config['FLASK_ENV'] = 'production'

VAULT_ADDR = os.environ['VAULT_ADDR']

@app.route('/')
def index():
    if request.authorization:
        auth = request.authorization
        client_IP = ''
        if 'Cf-Connecting-Ip' in request.headers:
            client_IP = request.headers['Cf-Connecting-Ip']
        else:
            client_IP = request.headers['X-Real-Ip']

        try:
            vc = hvac.Client(url=VAULT_ADDR, token=auth.password)
            assert vc.is_authenticated()
            print('LOGIN OK FROM [' + client_IP + '] : [' + auth.username + ']'), 200
            return make_response('LOGIN OK', 200), 200
        except:
            print('INVALID PASSWORD FROM [' + client_IP + '] : [' + auth.username + ':' + auth.password + ']'), 523
            pass
    return make_response('LOGIN FAILED', 401, {'WWW-Authenticate' : 'Basic realm="vault login required"'}), 401

if __name__ == '__main__':
    app.run(debug=True)

note: the Cf-Connecting-Ip header and HTTP 523 are just for Cloudflare