Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

group_alias memDB table does not get initialized properly #5288

Closed
uepoch opened this issue Sep 6, 2018 · 0 comments
Closed

group_alias memDB table does not get initialized properly #5288

uepoch opened this issue Sep 6, 2018 · 0 comments

Comments

@uepoch
Copy link
Contributor

uepoch commented Sep 6, 2018

Describe the bug
When identityStore is initialized (post-unseal, leadership taken) it does not properly fill the group_alias memDB table.
Since all aliases content are stored in the identity group as well, any update on the group, will correctly save the alias in MemDB.

To Reproduce

#!/bin/bash

export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN=devtoken

function poison_pill
{
	pkill -P $$
}

FILE=$(mktemp)

function vault_up
{
	vault server -dev -dev-root-token-id="$VAULT_TOKEN" 2>&1 > $FILE &
}

function unseal_key
{
    grep 'Unseal Key:' $FILE | awk '{print $3}' | tr -d '\n'
}

function vault_reseal
{
    vault operator seal
    vault operator unseal $(unseal_key)
}

vault_up

trap poison_pill EXIT

set -e

sleep 1

GROUP_ID=$(vault write -format=json identity/group type=external name=test-group | jq -r '.data.id' | tr -d '\n')

vault auth enable ldap

ACCESSOR=$(vault auth list -format=json | jq -r '.["ldap/"].accessor' | tr -d '\n')

ALIAS_ID=$(vault write -format=json identity/group-alias name=test-alias canonical_id=$GROUP_ID mount_accessor=$ACCESSOR | jq -r '.data.id' | tr -d '\n')


echo "--- LIST ALL ALIASES"
vault list identity/group-alias/id
echo "---------------------"

echo "Resealing Vault"
vault_reseal

sleep 1

echo "--- LIST ALL ALIASES AFTER RE-UNSEAL"
vault list identity/group-alias/id
echo "---------------------"

rm -f "$FILE"

exit 1

Expected behavior
Aliases should get loaded properly

Environment:

  • Vault Server Version (retrieve with vault status): master ( tested on 0.10 and 0.11 too)
  • Vault CLI Version (retrieve with vault version): can be made via api calls
  • Server Operating System/Architecture: all

Additional context
Impacts all backends as it's a functional problem in identityStore, not backend specific layer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant