hashicorp / hashicorp/vault-plugin-auth-jwt

Support for JWT and OIDC roles at the same mount path

Open
#84 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

When using the JWT/OIDC auth provider, if oidc_client_id and oidc_client_secret are configured as shown in the [example](https://www.vaultproject.io/docs/auth/jwt.html#configuration), JWT validation results in an error. Can the plugin support both JWT and OIDC at the same mount path?

For example, the following will work for OIDC (AzureAD) role types:
```
vault write auth/${OIDC_PATH}/config \
default_role="default" \
bound_issuer="https://sts.windows.net/${TENANT_ID}/" \
oidc_client_id="${CLIENT_ID}" \
oidc_client_secret="${CLIENT_SECRET}" \
oidc_discovery_url="https://sts.windows.net/${TENANT_ID}/"
```

OIDC login works with this setup, but JWT fails with the following:
```
$ vault write auth/${OIDC_PATH}/login role=app-abc jwt=$VALID_JWT_TOKEN
Error writing data to auth/oidc/azuread/login: Error making API request.

URL: PUT http://localhost:8200/v1/auth/oidc/azuread/login
Code: 500. Errors:

* unhandled case during login
```

For example, the following will work for JWT (AzureAD) role types:
```
vault write auth/${OIDC_PATH}/config \
default_role="default" \
bound_issuer="https://sts.windows.net/${TENANT_ID}/" \
oidc_discovery_url="https://sts.windows.net/${TENANT_ID}/"
```

OIDC will not work with this configuration as OIDC is not enabled.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.