// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-oidc-federation.adoc

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-vault-authenticate-secret_{context}"]
= Authenticating and retrieving the secret

[role="_abstract"]
Use the demonstration application to fetch a JWT token from the SPIFFE Workload API. Use the token to authenticate with Vault so that you can securely retrieve the secret and verify the workflow.

.Procedure

. Fetch a JWT-SVID by running the following command inside the running client pod:
+
[source,terminal]
----
$ oc -n $APP_NAMESPACE exec -it $(oc get pod -o=jsonpath='{.items[*].metadata.name}' -l app=$APP_NAME -n $APP_NAMESPACE) \
  -- /opt/spire/bin/spire-agent api fetch jwt \
  -socketPath /run/spire/sockets/spire-agent.sock \
  -audience $AUDIENCE
----

. Copy the token from the output and export it as an environment variable on your local machine by running the following command:
+
[source,terminal]
----
$ export IDENTITY_TOKEN=<Your-JWT-Token>
----

. Crate a new environment variable by running the following command:
+
[source,terminal]
----
$ export ROLE="${NAME}-role"
----

. Use `curl` to send the JWT token to the Vault login endpoint to get a Vault client token by running the following command:
+
[source,terminal]
----
$ VAULT_TOKEN=$(curl -s --request POST --data '{ "jwt": "'"${IDENTITY_TOKEN}"'", "role": "'"${ROLE}"'"}' "${VAULT_ADDR}"/v1/auth/jwt/login | jq -r '.auth.client_token')
----

.Verification

* Use the newly acquired Vault token to read the secret from the KV store by running the following command:
+
[source,terminal]
----
$ curl -s -H "X-Vault-Token: $VAULT_TOKEN" $VAULT_ADDR/v1/secret/$NAME | jq
----
+
You should see the contents of the secret (`"version": "v0.1.0"`) in the output, confirming the entire workflow is successful

