search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
31.29k stars 4.23k forks source link

OIDC: error when service URL is subdomain of issuer. Need SkipIssuerCheck or better #8780

Open techs07 opened 4 years ago

techs07 commented 4 years ago

vault version: 1.3.2

I am try to set up OIDC auth in vault 1.4.0 and getting some issues while saving the configuration. I have tried in on both UI and CLI.

Configuration: OIDC discovery URL: https://xxx-xxxxxxxxxx.identity.mycloud.com Issuer value in response: https://identity.mycloud.com

Error Message: checking oidc discovery URL: error creating provider with given values: oidc: issuer did not match the issuer returned by provider, expected "https://xxx-xxxxxxxxxx.identity.mycloud.com" got "https://identity.mycloud.com/

Expected Behaviour: As discovery URLis a subdomain of the issuer present in the response of 'https://xxxx-xxxx.identity.mycloud.com/.well-known/openid-configuration', it should allowed as valid configuration or there is should be an option to allow the sub domains.

techs07 commented 4 years ago

is there any plan to support this ? Same behaviour is observed in vault 1.4.0 as well

techs07 commented 4 years ago

Is there any option to pass SkipIssuerCheck in vault configs ? (coreos/go-oidc)