Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vault SSH backend: Cannot have '@' symbol in path #7915

Closed
adongy opened this issue Nov 20, 2019 · 1 comment · Fixed by #8038
Closed

Vault SSH backend: Cannot have '@' symbol in path #7915

adongy opened this issue Nov 20, 2019 · 1 comment · Fixed by #8038
Labels
bug Used to indicate a potential bug secret/ssh

Comments

@adongy
Copy link
Contributor

adongy commented Nov 20, 2019

Is your feature request related to a problem? Please describe.
I'm trying to deploy a ssh role per identity. It turns out my identifier is an email.
When creating a role with the '@' symbol in it, Vault complains about the path.

Error: error writing role "user@domain.com" for backend "ssh-client-signer": Error making API request.

URL: PUT https://vault.internal.domain.com/v1/ssh-client-signer/roles/user@domain.com
Code: 404. Errors:

* 1 error occurred:
	* unsupported path

Describe the solution you'd like
I'd like Vault to accept the @ character

Describe alternatives you've considered
I could try to replace the character and use a different id across my Vault config, but it's an additional step to take into account.

Explain any additional use-cases
If there are any use-cases that would help us understand the use/need/value please share them as they can help us decide on acceptance and prioritization.

Additional context
I'm logging in through oidc with GSuite SSO and the only ids in the response are a user id (bunch of numbers) or the email. User ids, while immutable, are one more step to correlate to trace back to a user.
This has already been done in the following issue:
#5645

@michelvocks michelvocks added bug Used to indicate a potential bug secret/ssh labels Nov 25, 2019
@adongy
Copy link
Contributor Author

adongy commented Dec 17, 2019

Coming back to this, I have an extra use-case:

Consider a templated policy:

path "ssh-client-signer/roles/{{identity.entity.metadata.email}}-*" {
  capabilities = ["create", "update"]
}

This will not work, since @ is not accepted. Furthermore, since templating does not support calling functions (such as replace), I cannot find an easy way to allow a specific user to a list of roles using templates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug secret/ssh
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants