hashicorp / hashicorp/vault-plugin-auth-jwt
Support for JWT and OIDC roles at the same mount path
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
When using the JWT/OIDC auth provider, if oidc_client_id and oidc_client_secret are configured as shown in the [example](https://www.vaultproject.io/docs/auth/jwt.html#configuration), JWT validation results in an error. Can the plugin support both JWT and OIDC at the same mount path?
For example, the following will work for OIDC (AzureAD) role types:
```
vault write auth/${OIDC_PATH}/config \
default_role="default" \
bound_issuer="https://sts.windows.net/${TENANT_ID}/" \
oidc_client_id="${CLIENT_ID}" \
oidc_client_secret="${CLIENT_SECRET}" \
oidc_discovery_url="https://sts.windows.net/${TENANT_ID}/"
```
OIDC login works with this setup, but JWT fails with the following:
```
$ vault write auth/${OIDC_PATH}/login role=app-abc jwt=$VALID_JWT_TOKEN
Error writing data to auth/oidc/azuread/login: Error making API request.
URL: PUT http://localhost:8200/v1/auth/oidc/azuread/login
Code: 500. Errors:
* unhandled case during login
```
For example, the following will work for JWT (AzureAD) role types:
```
vault write auth/${OIDC_PATH}/config \
default_role="default" \
bound_issuer="https://sts.windows.net/${TENANT_ID}/" \
oidc_discovery_url="https://sts.windows.net/${TENANT_ID}/"
```
OIDC will not work with this configuration as OIDC is not enabled.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.