Closed jimfang closed 2 years ago
Hello @jimfang this behavior is expected, by supplying a refresh_token the secrets engine is able to automatically obtain new tokens and operate without interruption whenever the access_token expires, normally you should not have to perform any other configuration related to access/refresh tokens in order to issue/import certificates to Trust Protection Platform unless you need to modify the Venafi Secret then it may require you to provide a new access_token and refresh_token (i.e. depending upon whether the original set of tokens has been refreshed by the secrets engine plugin).
Hi @ricrodriguezg , thanks very much for your quick reply. Consider one using scenario, there are 2+ Vault servers, connect to the same TPP server.
Another using scenario is setting up vault with docker container. We did venafi secret config and play around. The next day, docker container stop/start, so we restart the instance and do the same configuration. Error 400 will appear.
Hi @jimfang, regarding your first scenario, is this a vault cluster? if so, the configuration of the plugin can be applied in any of the instances of the cluster and that should automatically synchronize the changes to the other instances. If that is not the case and you are working with independent instances, you need to configure each instance with a different pair of tokens (refresh and access).
For the docker scenario, you should use a different pair of tokens once you perform a new configuration of the plugin since the original tokens would have likely been refreshed by it.
Hi @ricrodriguezg, Thanks very much. For first scenario, it is two different vault instances/cluster. They are independent.
I got your point that token should be configured once and it is expected to use for long. Both scenarios need a different pair of tokens as long as running command again. I will notice the team and see if there is other issues after configure tokens.
Hi @ricrodriguezg , there is an issue i found by using tokens to auth, the cert issued in vault cannot be seen in Venafi monitoring folder.
Environment: The service role in TPP, vault in my local are all the same. Using different ways to auth: 1. with tpp_user/tpp_password, 2. with access_token/refresh_token.
Reproduced steps:
Thanks.
This is the parameters to fetch token. $Param = @{ "username" = “**_local” "password" = “*****” "client_id" = “hashicorp-vault-monitor-by-venafi” "scope" = “certificate:manage” }
Hi @ricrodriguezg , i tried different scope to fetch token. The issue is solved. Thanks.
$Param = @{ "username" = “_local” "password" = “***” "client_id" = “hashicorp-vault-monitor-by-venafi” "scope" = “certificate:discover,manage” }
PROBLEM SUMMARY Using below commands to config Venafi secrets, it works properly with username and password for all time but only work once with access token and refresh token for that session. While doing the same command again with the same access token and refresh token, it gives 400 bad request. The access token validity for 90 days and refresh token is enabled as well as the grant expiration is upto 365 days which is TPP defaults, also we are using the default API application integration
vault write pki/venafi/tpp url="https://<;TPP_URL>" trust_bundle_file="/target_path/bundle.pem" access_token="" refresh_token="" OR vault write pki/venafi/tpp url="https://<;TPP_URL>" trust_bundle_file="/target_path/bundle.pem" tpp_user="**" tpp_password="***"
STEPS TO REPRODUCE
EXPECTED RESULTS Venafi secrets is configured successfully every time no matter user/password or access_token/refresh_token
ACTUAL RESULTS access_token and refresh_token only worked once
ENVIRONMENT DETAILS Vault setup in the docker container of laptop TPP server hosted on DEV VM Server
COMMENTS/WORKAROUNDS Every time before config, regenerate a new acess_token and refresh_token.