Regression: OIDC Login 'role with oidc role_type is not allowed' #14671

braunsonm · 2022-03-23T18:41:08Z

Describe the bug
Starting in 1.10.0, our OIDC login flow will error with Authentication failed: role with oidc role_type is not allowed

The popup window will go to Microsoft (in my case) which returns a 200, on the page that says "Completing the sign-in process..", it finishes and closes. The main UI updates to say that error.

To Reproduce
Steps to reproduce the behavior:

Initialize Vault like so. This assumes you have an Azure AD to use

vault auth enable oidc
vault write auth/oidc/config -<<"EOH"
{
   "oidc_client_id": "your_client_id",
   "oidc_client_secret": "your_client_secret",
   "default_role": "default",
   "oidc_discovery_url": "https://login.microsoftonline.com/<snip>/v2.0",
   "oidc_response_mode": "form_post",
   "oidc_response_types": [
    "id_token"
   ],
   "provider_config": {
      "provider": "azure"
   }
}
EOH
vault write auth/oidc/role/default user_claim="preferred_username" allowed_redirect_uris="http://localhost:8250/oidc/callback,https://vault.example.com/ui/vault/auth/oidc/oidc/callback" groups_claim="groups" policies=default oidc_scopes="https://graph.microsoft.com/.default profile"

Navigate to the UI and try to login with the OIDC provider
Error will appear after completing login flow with OIDC provider

Expected behavior
The login flow should work correctly as in 1.9.4.

Environment:

Vault Server Version (retrieve with vault status): 1.10.0
Server Operating System/Architecture: Docker Image on Ubuntu 18.04

Vault server configuration file(s):

storage "file" {
  path    = "/vault/file"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

api_addr = "http://127.0.0.1:8200"
ui = true
log_level = "Trace"

Additional context
This worked in the version directly before 1.9.4.

A similar bug happened in 1.8.0 which was a confirmed bug: #12239
And again in 1.9.1: #13460

This is the third bug that has appeared in OIDC login in the past 3 minor releases.

The text was updated successfully, but these errors were encountered:

austingebauer · 2022-03-24T16:46:47Z

Hi, @braunsonm. Thanks for opening this issue. We've determined that this error occurs when logging in through the Vault UI using an OIDC auth mount listed in the "tabs" of the login form. The auth mounts listed in these "tabs" are those that have listing_visibility set to unauth.

The team is working on a fix for this. Until then, there is a workaround. Instead of selecting the specific OIDC auth mount from the "tabs", select the "Other" tab. From there, you'll see a "Method" select box where you can select "OIDC". Let me know if this works for you.

Again, we apologize for these regressions in the OIDC auth form. These issues have helped us identify testing gaps, so we really appreciate you opening them.

braunsonm · 2022-03-24T17:05:42Z

Thanks @austingebauer that work around does in fact work.

Appreciate the quick responses I have gotten in reporting these issues to Hashicorp.

silentpete · 2022-05-31T21:41:11Z

Just to state, I have confirmed this has been resolved with upgrading from 1.9.6 to 1.10.3

klaphi · 2022-09-29T07:33:15Z

We updated Vault from 1.10.4 to 1.11.3 and the problem is back again. Please reopen.

iniinikoski · 2022-09-30T20:28:49Z

Can confirm what @klaphi says - the problem is back on version 1.11.3 (which is the latest also in HCP Vault). Not a good thing...

heatherezell · 2022-09-30T20:32:12Z

Re-opening, thank you for these reports!

xoxys · 2022-10-13T08:07:30Z

Is 1.12.0 still affected?

jeffmccune · 2022-10-20T02:27:40Z

@xoxys Yes, 1.12.0 is unfortunately still affected.

Error Authentication failed: role with oidc role_type is not allowed

driskell · 2022-10-21T17:16:07Z

This has completedly blocked for me as I am unable to login. It looks like the workaround only works if you are using the default oidc/ path. If you're using multiple oidc configurations with different paths, it is no longer usable in the UI.

driskell · 2022-10-21T17:20:09Z

Seems to successfully process the callback but then proceeds to call the OIDC path /login with empty parameters in request body, which returns this error.

If I inspect and grab the client token from the callback response I can login using Token method but that's a bit long winded. 😬

jeffmccune · 2022-10-21T19:21:41Z

I have an admin login on an alternate path and it also doesn’t work from the GUI. I agree this is a serious issue because we can’t upgrade everywhere for security patches due to not being able to log into our admin accounts. As a work around, which isn’t great because it requires a CLI, I’ve been getting a token from the CLI oidc method and admin path then pasting it into the token method in the GUI.

heatherezell · 2022-10-21T19:34:02Z

Hi folks! Thanks again for these reports. Our engineering team has assigned this to be investigated soon - ideally next week. Thank you all for your patience, as I know this is frustrating to deal with.

zofskeez · 2022-10-25T17:56:32Z

@jeffmccune I'm seeing some issues with alternate mount paths as well but I'm not seeing the original issue on 1.11.3 or 1.12.0. Are you able to provide more information on how you arrive at Error Authentication failed: role with oidc role_type is not allowed? It works for me with the default oidc mount path.

driskell · 2022-10-26T11:49:05Z

@zofskeez The original issue was fixed as it relates to default mount path, but got reopened. I am unsure if the reopening was due to the default mount path again, or the issue with alternative paths. Either way there is definitely an issue with alternative mount paths. I believe @jeffmccune was using alternative path, not default path, and your example is showing successful with default path.

zofskeez · 2022-10-26T15:02:03Z

Thanks @driskell. That supports what I am finding. Just want to make sure there wasn't a regression with the original fix.

jeffmccune · 2022-10-26T15:16:40Z

@zofskeez I have some dev/test clusters which are accessible if you'd like to look at what might be different about my setup. In the meantime, here's the config I'm using:

Dex is the oidc provider. Here's the setup, please let me know if this isn't sufficient to reproduce the error and I'll try another approach.

Enable the jwt auth method:

vault auth enable -path=oidc jwt

vault read -format=json auth/oidc/config

{
  "request_id": "08f59f51-fd18-e5a1-afa1-63235cd256e7",
  "lease_id": "",
  "lease_duration": 0,
  "renewable": false,
  "data": {
    "bound_issuer": "",
    "default_role": "default",
    "jwks_ca_pem": "",
    "jwks_url": "",
    "jwt_supported_algs": [],
    "jwt_validation_pubkeys": [],
    "namespace_in_state": true,
    "oidc_client_id": "vault.fc9a44ff524e2c6ebf36fbd65b8a51eb",
    "oidc_discovery_ca_pem": "",
    "oidc_discovery_url": "https://auth.k2.ois.run",
    "oidc_response_mode": "",
    "oidc_response_types": [],
    "provider_config": {}
  },
  "warnings": null
}

vault read -format=json sys/auth/oidc

{
  "request_id": "9bee5073-6c0b-ec04-55bb-cb9cdede4e06",
  "lease_id": "",
  "lease_duration": 0,
  "renewable": false,
  "data": {
    "accessor": "auth_jwt_aced0224",
    "config": {
      "default_lease_ttl": 0,
      "force_no_cache": false,
      "listing_visibility": "unauth",
      "max_lease_ttl": 0,
      "token_type": "default-service"
    },
    "deprecation_status": "supported",
    "description": "k2 cluster standard single sign on for normal access.  Use the default role.  If you get Authentication failed: role with oidc role_type is not allowed, then use the Other tab and select OIDC to login.  See vault issue 14671.",
    "external_entropy_access": false,
    "local": false,
    "options": null,
    "plugin_version": "",
    "running_plugin_version": "v0.14.0+builtin",
    "running_sha256": "",
    "seal_wrap": false,
    "type": "jwt",
    "uuid": "9e701671-41f8-841d-d2c2-0f48ae04afa4"
  },
  "warnings": null
}

Set the default role:

vault write auth/oidc/role/default

vault write auth/oidc/role/default -<<EOF
{
  "role_type": "oidc",
  "user_claim": "email",
  "policies": "default",
  "ttl": "10h",
  "groups_claim": "groups",
  "claim_mappings": {
    "sub": "sub",
    "email": "email",
    "name": "name",
    "iss": "iss"
  },
  "oidc_scopes": [
    "email",
    "profile",
    "groups"
  ],
  "bound_claims": {
    "groups": [
      "vault-admin@ois.run",
      "cluster-admin@ois.run",
      "cluster-edit@ois.run",
      "cluster-view@ois.run"
    ]
  },
  "allowed_redirect_uris": [
    "http://localhost:8250/oidc/callback",
    "https://vault.core.${OIX_ORG_DOMAIN}/ui/vault/auth/oidc/oidc/callback",
    "https://vault.${OIX_DNS_DOMAIN}/ui/vault/auth/oidc/oidc/callback",
    "https://vault-ui.vault.svc:8200/ui/vault/auth/oidc/oidc/callback"
  ]
}
EOF

jeffmccune · 2022-10-26T15:25:03Z

I believe @jeffmccune was using alternative path, not default path, and your example is showing successful with default path.

@zofskeez I get the error for the default role on the default path. I'm also using a second path which does not work, but in a different way.

Default path / role:

Alternate path: (Button does nothing)

Note however, both methods work great on the command line:

vault login -method=oidc -path=oidc-admin
vault login -method=oidc

jeffmccune · 2022-10-26T15:47:43Z

One last comment, I'm mounting the jwt method at the oidc default path because it's the only method I could find which supports role based groups claims.

If I replace vault auth enable -path=oidc jwt with vault auth enable -path=oidc oidc then external group identity policies stop working:

vault login -method=oidc

token_policies       ["default"]
identity_policies    []
policies             ["default"]

vault write auth/oidc/role/default

vault write auth/oidc/role/default -<<EOF
{
  "role_type": "oidc",
  "user_claim": "email",
  "policies": "default",
  "ttl": "10h",
  "groups_claim": "groups",
  "claim_mappings": {
    "sub": "sub",
    "email": "email",
    "name": "name",
    "iss": "iss"
  },
  "oidc_scopes": [
    "email",
    "profile",
    "groups"
  ],
  "bound_claims": {
    "groups": [
      "vault-admin@ois.run",
      "cluster-admin@ois.run",
      "cluster-edit@ois.run",
      "cluster-view@ois.run"
    ]
  },
  "allowed_redirect_uris": [
    "http://localhost:8250/oidc/callback",
    "https://vault.core.${OIX_ORG_DOMAIN}/ui/vault/auth/oidc/oidc/callback",
    "https://vault.${OIX_DNS_DOMAIN}/ui/vault/auth/oidc/oidc/callback",
    "https://vault-ui.vault.svc:8200/ui/vault/auth/oidc/oidc/callback"
  ]
}
EOF

zofskeez · 2022-10-26T15:50:26Z

Great thanks @jeffmccune for the detailed response! I have prepared a fix for the alternate path case but the default path and role is interesting. One difference between our setups is that I was enabling the oidc auth method whereas you are using jwt. The code paths should be the same but there may be a bug somewhere with jwt.

jeffmccune · 2022-10-26T15:53:27Z

One difference between our setups is that I was enabling the oidc auth method whereas you are using jwt.

TL;DR: Solved, problem was using vault auth enable -path=oidc jwt. Fixed by using vault auth enable -path=oidc oidc

Yes, this is in fact the problem with my setup. I realized the identity policies weren't working because I disabled the jwt method and enabled the oidc method, resulting in a new accessor.

Once I re-created all of my external groups with the correct accessor for the oidc auth type, both the oidc default path and default role in the UI and the CLI work as expected.

jeffmccune · 2022-10-26T15:58:13Z

As a suggestion, I thought this should work because JWT/OIDC Auth Method mentions:

The jwt auth method can be used to authenticate with Vault using OIDC or by providing a JWT.

And:

Enable the JWT auth method. Either the "jwt" or "oidc" name may be used.

zofskeez · 2022-10-26T16:53:59Z

Once I re-created all of my external groups with the correct accessor for the oidc auth type, both the oidc default path and default role in the UI and the CLI work as expected.

Good to hear! You should have been able to log in with your original config though without seeing the role_type error.

Seems to successfully process the callback but then proceeds to call the OIDC path /login with empty parameters in request body, which returns this error.

I'm seeing the same thing as @driskell now when I use the jwt auth method rather than oidc which is still working from the original fix using the mount path tabs.

jeffmccune · 2022-10-26T18:00:26Z

Summary of issues affecting 1.12.0:

vault auth enable -path=oidc jwt results in role_type error in the web ui when listing_visibility is unauth. Work-arounds: vault auth enable oidc instead, or use "Other" tab with jwt method.
Cannot login to web ui using a non-default path with the jwt or oidc methods, button is unresponsive. Work-around: vault login -method=oidc -path=oidc-admin on CLI, then copy the resulting token into the web ui token method.

santachago · 2022-11-23T02:46:08Z

Hi i am facing the same issue on version 1.12.1, but in my case OIDC was working perfectly on the CLI and UI before enabling MFA with DUO, after MFA was enabled the UI started giving this same error while CLI is working as expected.
On the UI also tried not using the oicd tab and going with the "other" method but still not working.

acortes-okode · 2022-11-25T13:19:10Z

Hi all,

I have a related issue on 1.11.3 trying to perform JWT login on /v1/auth/oidc/login (also have tested /v1/auth/jwt/login):

curl -X POST \
-d '{"jwt": "MY.JWT.TOKEN"}' \
https://vault.mydomain.com/v1/auth/oidc/login

{"errors":["role with oidc role_type is not allowed"]}

No issues on the UI with OIDC method, it works as expected. The callback URL (v1/auth/oidc/oidc/callback) is called correctly with state and code parameters and it returns the client_token to the UI.

maxb · 2022-11-25T14:22:15Z

@acortes-okode That is unrelated, and is actually Vault functioning as designed. Each role you configure in the OIDC/JWT auth method can be used for OIDC login or JWT login but not both. The role's role_type must be configured to the one you want to use Please open a discussion topic at https://discuss.hashicorp.com if you'd like further assistance understanding this detail of how to configure Vault.

xskrasek · 2023-01-31T13:03:41Z

Hi, I want to report the same behaviour as described by @santachago, except I am using MFA with TOTP and not with DUO. I get this issue in unauth and other tab. If I disable MFA, UI starts working. CLI works even with MFA.

tks98 · 2023-02-22T21:26:03Z

+1 on the issues seen by @xskrasek and @santachago. Saw issues after enabling duo MFA for my oidc auth method when logging in via the UI. Works via the CLI.

tks98 · 2023-03-07T16:23:30Z

If anyone else is in a similar situation/setup (Duo + AAD), I was able to enable Duo on the Azure AD App end for Vault and circumvent this issue. Also this prevents having to configure and enable Duo on the Vault end.

https://duo.com/docs/azure-ca

So if anyone is using Azure AD this could provide a potential workaround/solution for you.

zofskeez · 2023-03-29T16:20:29Z

I'm going to close this since the original reported issue was fixed in #17661. Please open a new issue for anything else that was mentioned.

heatherezell added ecosystem auth/oidc secret/azure labels Mar 23, 2022

hashishaw added the ui label Mar 23, 2022

austingebauer mentioned this issue Mar 24, 2022

docs: adds known issue for UI sign in using OIDC auth method #14708

Merged

This was referenced Mar 24, 2022

Backport of docs: adds known issue for UI sign in using OIDC auth method into stable-website #14712

Merged

Backport of docs: adds known issue for UI sign in using OIDC auth method into release/1.10.x #14713

Merged

austingebauer mentioned this issue Mar 28, 2022

oidc role type not working on version 1.10.0 #14727

Closed

hashishaw linked a pull request Apr 6, 2022 that will close this issue

OIDC Login Bug #14916

Merged

zofskeez closed this as completed in #14916 Apr 7, 2022

bastjan mentioned this issue Apr 8, 2022

Update docker.io/vault Docker tag to v1.13.3 projectsyn/component-vault#15

Merged

1 task

heatherezell reopened this Sep 30, 2022

zofskeez mentioned this issue Oct 26, 2022

OIDC Alternate Path Bug #17661

Merged

This was referenced Oct 26, 2022

Backport of OIDC Alternate Path Bug into release/1.10.x #17682

Closed

Backport of OIDC Alternate Path Bug into release/1.11.x #17683

Closed

Backport of OIDC Alternate Path Bug into release/1.12.x #17684

Closed

zofskeez closed this as completed Mar 29, 2023

sknopp mentioned this issue May 4, 2023

Login using Azure AD JWT Token hvac/hvac#985

Open

karelkryda mentioned this issue Jul 7, 2023

OIDC Login with MFA TOTP reports 'role with oidc role_type is not allowed' #19702

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Regression: OIDC Login 'role with oidc role_type is not allowed' #14671

Regression: OIDC Login 'role with oidc role_type is not allowed' #14671

braunsonm commented Mar 23, 2022 •

edited

Loading

austingebauer commented Mar 24, 2022

braunsonm commented Mar 24, 2022

silentpete commented May 31, 2022 •

edited

Loading

klaphi commented Sep 29, 2022

iniinikoski commented Sep 30, 2022 •

edited

Loading

heatherezell commented Sep 30, 2022

xoxys commented Oct 13, 2022

jeffmccune commented Oct 20, 2022

driskell commented Oct 21, 2022

driskell commented Oct 21, 2022

jeffmccune commented Oct 21, 2022 via email

heatherezell commented Oct 21, 2022

zofskeez commented Oct 25, 2022

driskell commented Oct 26, 2022 •

edited

Loading

zofskeez commented Oct 26, 2022

jeffmccune commented Oct 26, 2022 •

edited

Loading

jeffmccune commented Oct 26, 2022

jeffmccune commented Oct 26, 2022

zofskeez commented Oct 26, 2022 •

edited

Loading

jeffmccune commented Oct 26, 2022

jeffmccune commented Oct 26, 2022

zofskeez commented Oct 26, 2022

jeffmccune commented Oct 26, 2022 •

edited

Loading

santachago commented Nov 23, 2022

acortes-okode commented Nov 25, 2022

maxb commented Nov 25, 2022

xskrasek commented Jan 31, 2023

tks98 commented Feb 22, 2023 •

edited

Loading

tks98 commented Mar 7, 2023 •

edited

Loading

zofskeez commented Mar 29, 2023

Regression: OIDC Login 'role with oidc role_type is not allowed' #14671

Regression: OIDC Login 'role with oidc role_type is not allowed' #14671

Comments

braunsonm commented Mar 23, 2022 • edited Loading

austingebauer commented Mar 24, 2022

braunsonm commented Mar 24, 2022

silentpete commented May 31, 2022 • edited Loading

klaphi commented Sep 29, 2022

iniinikoski commented Sep 30, 2022 • edited Loading

heatherezell commented Sep 30, 2022

xoxys commented Oct 13, 2022

jeffmccune commented Oct 20, 2022

driskell commented Oct 21, 2022

driskell commented Oct 21, 2022

jeffmccune commented Oct 21, 2022 via email

heatherezell commented Oct 21, 2022

zofskeez commented Oct 25, 2022

driskell commented Oct 26, 2022 • edited Loading

zofskeez commented Oct 26, 2022

jeffmccune commented Oct 26, 2022 • edited Loading

jeffmccune commented Oct 26, 2022

jeffmccune commented Oct 26, 2022

zofskeez commented Oct 26, 2022 • edited Loading

jeffmccune commented Oct 26, 2022

jeffmccune commented Oct 26, 2022

zofskeez commented Oct 26, 2022

jeffmccune commented Oct 26, 2022 • edited Loading

santachago commented Nov 23, 2022

acortes-okode commented Nov 25, 2022

maxb commented Nov 25, 2022

xskrasek commented Jan 31, 2023

tks98 commented Feb 22, 2023 • edited Loading

tks98 commented Mar 7, 2023 • edited Loading

zofskeez commented Mar 29, 2023

braunsonm commented Mar 23, 2022 •

edited

Loading

silentpete commented May 31, 2022 •

edited

Loading

iniinikoski commented Sep 30, 2022 •

edited

Loading

driskell commented Oct 26, 2022 •

edited

Loading

jeffmccune commented Oct 26, 2022 •

edited

Loading

zofskeez commented Oct 26, 2022 •

edited

Loading

jeffmccune commented Oct 26, 2022 •

edited

Loading

tks98 commented Feb 22, 2023 •

edited

Loading

tks98 commented Mar 7, 2023 •

edited

Loading