smallstep / certificates

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
https://smallstep.com/certificates
Apache License 2.0
6.38k stars 417 forks source link

[Bug]: wrong oidc provisioner config prevents startup, can't remove provisioner #1757

Open PeterGrace opened 4 months ago

PeterGrace commented 4 months ago

Steps to Reproduce

Your Environment

Expected Behavior

I'd like to be able to start step-ca so that I can remove or repair the faulty provisioner config

Actual Behavior

step-ca errors on start, no way to change the provisioner config

Additional Context

I attempted to remediate by turning off remoteAdmin which allows step-ca to start, but it also appears to not read the database, so the provisioner list is [] when remoteAdmin is false, leaving me no ability to delete or edit the faulty provisioner.

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).