hashicorp / hashicorp/vault-plugin-auth-jwt

JWT external group is not created after a successfull login

Open
#17 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

Hello,

I am using the docker image of vault: library/vault:1.0.2

My JWT contains at the root level :
` "gitlab_group": [
"148:Divison Sécurité et Maîtrise des risques",
"81:escapegame",
"6:innovation",
"343:hackathon-LOS",
"5:annuaire"
],
"preferred_username": "tm8enk"`

An entity for me is created but i don't see any external groups
I created a role user with the following config
` "data": {
"bound_audiences": [
"onyxia"
],
"bound_cidrs": null,
"bound_subject": "",
"groups_claim": "gitlab_group",
"groups_claim_delimiter_pattern": "",
"max_ttl": 0,
"num_uses": 0,
"period": 0,
"policies": [
"default"
],
"ttl": 3600,
"user_claim": "preferred_username"
}`

In the debug log i see that :
`2019-01-16T22:05:47.325Z [DEBUG] identity: refreshing external group memberships: entity_id=91ead235-1800-deef-2787-d00ebca51efa group_aliases=["mount_accessor:"auth_jwt_c8d09a1c" name:"148:Divison S\303\251curit\303\251 et Ma\303\256trise des risques" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"81:escapegame" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"6:innovation" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"343:hackathon-LOS" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"5:annuaire" "]
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=auth/jwt/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=identity/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=cubbyhole/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=secret/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=sys/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=auth/token/`
`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the JWT login using the shown groups_claim configuration and inspect the external-group refresh logged during authentication. Trace how the gitlab_group values are handled after login; done means the listed external groups are created and associated with the authenticated entity.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.