hashicorp / hashicorp/vault-plugin-auth-jwt

"'oidc_discovery_url' must be set for OIDC" when trying to use jwks_url

Open
#272 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

According the the documentation, https://developer.hashicorp.com/vault/api-docs/auth/jwt#configure we can configure a jwt auth backend with one (and only one) of
- oidc_discovery_url
- jwks_url
- jwt_validation_pubkeys

However, the configuration with `jwks_url` only is not possible when we're using the `client_id` / `client_secret` authentication
Setting (terraform):
```

resource "vault_jwt_auth_backend" "keycloak" {
for_each = toset(var.keycloak_datacenters)
description = "Keycloak"
path = "oidc-${each.value}"
type = "oidc"
jwks_url = "${var.keycloak_url_backend[each.value]}/auth/realms/master/protocol/openid-connect/certs"
bound_issuer = "${var.keycloak_url_frontend[each.value]}/auth/realms/OmCloud"
oidc_client_id = var.keycloak_client_id
oidc_client_secret = var.keycloak_client_secret
default_role = "default-keycloak-${each.value}"
tune {
default_lease_ttl = "2h"
max_lease_ttl = "8h"
allowed_response_headers = []
audit_non_hmac_request_keys = []
audit_non_hmac_response_keys = []
listing_visibility = "unauth"
passthrough_request_headers = []
token_type = "default-service"
}
}
```

When trying to apply this configuration, we get:
```
│ * 'oidc_discovery_url' must be set for OIDC

│ with vault_jwt_auth_backend.keycloak["xxx"],
│ on auth_backend_keycloak.tf line 6, in resource "vault_jwt_auth_backend" "keycloak":
│ 6: resource "vault_jwt_auth_backend" "keycloak" {

```

We can see in the source code here: https://github.com/hashicorp/vault-plugin-auth-jwt/blob/main/path_config.go#L279
that this error appears due to `client_id` being present without `OIDCDiscoveryURL`

By removing `client_id` / `client_secret` we can apply successfully the configuration but of course then it's not working because the `jwks_url` doesn't provide `client_id` / `client_secret`

Tested with vault 1.15.4+ent

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with vault-plugin-auth-jwt/path_config.go around line 279 and compare the documented jwks_url-only configuration with the supplied OIDC client credentials. Reproduce the Terraform configuration and trace why client_id requires oidc_discovery_url; done means a valid jwks_url configuration with client_id and client_secret is accepted without that discovery URL.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.