hashicorp / hashicorp/vault-plugin-auth-jwt

OIDC URL encoding bug in `allowed_redirect_uris` with nested namespaces

Open
#81 2 comments 3 reactions 1 assignee Claimed by @kalafut View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

**Describe the bug**
When configuring the OIDC role, `allowed_redirect_uris` must have url encoding for the appended namespace(s) when using nested namespaces.

It may be better for vault to accept and store the url parameters in a human-readable fashion, ie. not encoded or to at least explicitly mention this quirk in the documentation.

**To Reproduce**
Steps to reproduce the behavior:
1. Create namespace1
2. Create namespace2 that is nested under namespace1
3. Enable and configure OIDC auth
4. Run
```
vault write auth/oidc/role/rolename \
bound_audiences="123456-abcdefg.apps.googleusercontent.com" \
allowed_redirect_uris="https://vaulturl.com:8200/ui/vault/auth/oidc/oidc/callback?namespace=namespace1/namespace2" \
user_claim="sub" \
policies="demo"
```

**Expected behavior**
Able to log in to nested namespace using OIDC

**Environment:**
* Vault Server Version (retrieve with `vault status`):
```
Version 1.2.2+ent
```
* Vault CLI Version (retrieve with `vault version`):
```
Vault v1.2.3+ent
```

**Additional context**
This works:
```
vault write auth/oidc/role/gmail \
bound_audiences="123456-abcdefg.apps.googleusercontent.com" \
allowed_redirect_uris="https://vaulturl.com:8200/ui/vault/auth/oidc/oidc/callback?namespace=namespace1%2Fnamespace2" \
user_claim="sub" \
policies="demo"
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.