hashicorp / hashicorp/vault-plugin-auth-jwt
"'oidc_discovery_url' must be set for OIDC" when trying to use jwks_url
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
According the the documentation, https://developer.hashicorp.com/vault/api-docs/auth/jwt#configure we can configure a jwt auth backend with one (and only one) of
- oidc_discovery_url
- jwks_url
- jwt_validation_pubkeys
However, the configuration with `jwks_url` only is not possible when we're using the `client_id` / `client_secret` authentication
Setting (terraform):
```
resource "vault_jwt_auth_backend" "keycloak" {
for_each = toset(var.keycloak_datacenters)
description = "Keycloak"
path = "oidc-${each.value}"
type = "oidc"
jwks_url = "${var.keycloak_url_backend[each.value]}/auth/realms/master/protocol/openid-connect/certs"
bound_issuer = "${var.keycloak_url_frontend[each.value]}/auth/realms/OmCloud"
oidc_client_id = var.keycloak_client_id
oidc_client_secret = var.keycloak_client_secret
default_role = "default-keycloak-${each.value}"
tune {
default_lease_ttl = "2h"
max_lease_ttl = "8h"
allowed_response_headers = []
audit_non_hmac_request_keys = []
audit_non_hmac_response_keys = []
listing_visibility = "unauth"
passthrough_request_headers = []
token_type = "default-service"
}
}
```
When trying to apply this configuration, we get:
```
│ * 'oidc_discovery_url' must be set for OIDC
│
│ with vault_jwt_auth_backend.keycloak["xxx"],
│ on auth_backend_keycloak.tf line 6, in resource "vault_jwt_auth_backend" "keycloak":
│ 6: resource "vault_jwt_auth_backend" "keycloak" {
│
```
We can see in the source code here: https://github.com/hashicorp/vault-plugin-auth-jwt/blob/main/path_config.go#L279
that this error appears due to `client_id` being present without `OIDCDiscoveryURL`
By removing `client_id` / `client_secret` we can apply successfully the configuration but of course then it's not working because the `jwks_url` doesn't provide `client_id` / `client_secret`
Tested with vault 1.15.4+ent
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with vault-plugin-auth-jwt/path_config.go around line 279 and compare the documented jwks_url-only configuration with the supplied OIDC client credentials. Reproduce the Terraform configuration and trace why client_id requires oidc_discovery_url; done means a valid jwks_url configuration with client_id and client_secret is accepted without that discovery URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100