hashicorp / hashicorp/vault-plugin-auth-jwt
JWT external group is not created after a successfull login
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
Hello,
I am using the docker image of vault: library/vault:1.0.2
My JWT contains at the root level :
` "gitlab_group": [
"148:Divison Sécurité et Maîtrise des risques",
"81:escapegame",
"6:innovation",
"343:hackathon-LOS",
"5:annuaire"
],
"preferred_username": "tm8enk"`
An entity for me is created but i don't see any external groups
I created a role user with the following config
` "data": {
"bound_audiences": [
"onyxia"
],
"bound_cidrs": null,
"bound_subject": "",
"groups_claim": "gitlab_group",
"groups_claim_delimiter_pattern": "",
"max_ttl": 0,
"num_uses": 0,
"period": 0,
"policies": [
"default"
],
"ttl": 3600,
"user_claim": "preferred_username"
}`
In the debug log i see that :
`2019-01-16T22:05:47.325Z [DEBUG] identity: refreshing external group memberships: entity_id=91ead235-1800-deef-2787-d00ebca51efa group_aliases=["mount_accessor:"auth_jwt_c8d09a1c" name:"148:Divison S\303\251curit\303\251 et Ma\303\256trise des risques" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"81:escapegame" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"6:innovation" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"343:hackathon-LOS" ", "mount_accessor:"auth_jwt_c8d09a1c" name:"5:annuaire" "]
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=auth/jwt/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=identity/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=cubbyhole/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=secret/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=sys/
2019-01-16T22:06:24.991Z [DEBUG] rollback: attempting rollback: path=auth/token/`
`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the JWT login using the shown groups_claim configuration and inspect the external-group refresh logged during authentication. Trace how the gitlab_group values are handled after login; done means the listed external groups are created and associated with the authenticated entity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100