hashicorp / hashicorp/vault-plugin-auth-jwt

Vault: api error: status code 400: error configuring token validator: keyset configuration error

Open
#306 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

I am having issues with Gitlab CI integration in my Vault instance.
On May 14th, Gitlab deprecated the `CI_JOB_JWT` and on May 15th I started to face the following error while my CI jobs try to authenticate with the JWT token signed by gitlab.com:
```
Using "vault" secret resolver...
ERROR: Job failed (system failure): resolving secrets:
initializing Vault service: preparing authenticated client:
authenticating Vault client:
writing to Vault: api error:
status code 400:
error configuring token validator:
keyset configuration error:
Get "https://gitlab.com/.well-known/openid-configuration": dial tcp 172.65.251.78:443: i/o timeout
```
My vault gitlab role looks like this:
```
vault read auth//config

Key Value
bound_issuer https://gitlab.com
default_role
jwks_ca_pem
jwks_url
jwt_supported_algs []
jwt_validation_pubkeys []
namespace_in_state true
oidc_client_id
oidc_discovery_ca_pem
oidc_discovery_url https://gitlab.com
oidc_response_mode
oidc_response_types []
provider_config {}
```
Here is my CI configuration:
```YAML
variables:
VAULT_SERVER_URL: "https://"
VAULT_AUTH_PATH: ""
[...]
tests:
id_tokens:
VAULT_ID_TOKEN:
aud: https://gitlab.com
secrets:
SECRET:
vault: @
token: $VAULT_ID_TOKEN
file: false
```
Gitlab is recommending id_tokens since a long ago as the desired way of authenticating.
IMPORTANT: I am not using the `CI_JOB_JWT` anywhere.

Based on the error, is it possible to actually figure out what is wrong with the JWT auth plugin?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the JWT/OIDC authentication path that configures the token validator and attempts discovery at GitLab's .well-known/openid-configuration endpoint. Reproduce the reported timeout and compare it with the displayed auth configuration; done means identifying whether the failure is in the plugin or external connectivity/configuration and documenting the diagnosis.

Written by the indexing model from the issue text.

Assessment

Tech stack
gitlab, go
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.