hashicorp / hashicorp/vault-plugin-auth-jwt
Vault: api error: status code 400: error configuring token validator: keyset configuration error
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
I am having issues with Gitlab CI integration in my Vault instance.
On May 14th, Gitlab deprecated the `CI_JOB_JWT` and on May 15th I started to face the following error while my CI jobs try to authenticate with the JWT token signed by gitlab.com:
```
Using "vault" secret resolver...
ERROR: Job failed (system failure): resolving secrets:
initializing Vault service: preparing authenticated client:
authenticating Vault client:
writing to Vault: api error:
status code 400:
error configuring token validator:
keyset configuration error:
Get "https://gitlab.com/.well-known/openid-configuration": dial tcp 172.65.251.78:443: i/o timeout
```
My vault gitlab role looks like this:
```
vault read auth//config
Key Value
bound_issuer https://gitlab.com
default_role
jwks_ca_pem
jwks_url
jwt_supported_algs []
jwt_validation_pubkeys []
namespace_in_state true
oidc_client_id
oidc_discovery_ca_pem
oidc_discovery_url https://gitlab.com
oidc_response_mode
oidc_response_types []
provider_config {}
```
Here is my CI configuration:
```YAML
variables:
VAULT_SERVER_URL: "https://"
VAULT_AUTH_PATH: ""
[...]
tests:
id_tokens:
VAULT_ID_TOKEN:
aud: https://gitlab.com
secrets:
SECRET:
vault: @
token: $VAULT_ID_TOKEN
file: false
```
Gitlab is recommending id_tokens since a long ago as the desired way of authenticating.
IMPORTANT: I am not using the `CI_JOB_JWT` anywhere.
Based on the error, is it possible to actually figure out what is wrong with the JWT auth plugin?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the JWT/OIDC authentication path that configures the token validator and attempts discovery at GitLab's .well-known/openid-configuration endpoint. Reproduce the reported timeout and compare it with the displayed auth configuration; done means identifying whether the failure is in the plugin or external connectivity/configuration and documenting the diagnosis.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100