hashicorp / hashicorp/vault-plugin-auth-jwt
OIDC URL encoding bug in `allowed_redirect_uris` with nested namespaces
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
**Describe the bug**
When configuring the OIDC role, `allowed_redirect_uris` must have url encoding for the appended namespace(s) when using nested namespaces.
It may be better for vault to accept and store the url parameters in a human-readable fashion, ie. not encoded or to at least explicitly mention this quirk in the documentation.
**To Reproduce**
Steps to reproduce the behavior:
1. Create namespace1
2. Create namespace2 that is nested under namespace1
3. Enable and configure OIDC auth
4. Run
```
vault write auth/oidc/role/rolename \
bound_audiences="123456-abcdefg.apps.googleusercontent.com" \
allowed_redirect_uris="https://vaulturl.com:8200/ui/vault/auth/oidc/oidc/callback?namespace=namespace1/namespace2" \
user_claim="sub" \
policies="demo"
```
**Expected behavior**
Able to log in to nested namespace using OIDC
**Environment:**
* Vault Server Version (retrieve with `vault status`):
```
Version 1.2.2+ent
```
* Vault CLI Version (retrieve with `vault version`):
```
Vault v1.2.3+ent
```
**Additional context**
This works:
```
vault write auth/oidc/role/gmail \
bound_audiences="123456-abcdefg.apps.googleusercontent.com" \
allowed_redirect_uris="https://vaulturl.com:8200/ui/vault/auth/oidc/oidc/callback?namespace=namespace1%2Fnamespace2" \
user_claim="sub" \
policies="demo"
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.