Removing Hashicorp Support #16446

pedroigor · 2023-01-13T12:43:05Z

pedroigor
Jan 13, 2023
Collaborator

We are planning to remove the out-of-box Hashicorp support for the following reasons:

After long discussions around supportability, we can not guarantee the proper level of support for quarkus-vault-extension, mainly in terms of security and potential CVEs.
We did not receive much feedback from the community or at least not as much as we want to justify supporting the capability. There are well-known issues associated with it like its very bad UX and limitations on the type of secrets that can be resolved from a vault
The project is working on a tool to install/remove Quarkus extensions from the distribution, making it possible to leverage the whole Quarkus ecosystem including Hashicorp support.
We are reviewing vault support as per Quarkus File Vault integration #15831.
It will unblock critical paths in our roadmap like slimming down the distribution to reduce its size even further. See Remove any unnecessary dependency from distribution #9075.

You can follow the work being done at #9144.

dicky-yuen · 2023-08-09T07:00:36Z

dicky-yuen
Aug 9, 2023

Hi @pedroigor
I upgraded my Keycloak to version 22, and my Vault OIDC authentication is thrown out below error message.
" Vault login failed. Error exchanging oidc code: "Provider.Exchange: unable to exchange auth code with provider: oauth2: cannot fetch token: 400 Bad Request\nResponse: {"error":"invalid_grant","error_description":"Code not valid"}"."*

Can I confirm Keycloak is also no longer support Vault OIDC logging in future release?

1 reply

pedroigor Aug 9, 2023
Collaborator Author

Sorry, can you please elaborate on what you mean by Vault OIDC?

The error you mentioned seems related to a failure when exchanging the authorization code with a token and not really with the Vault/Hashicorp support.

dicky-yuen · 2023-08-10T05:29:31Z

dicky-yuen
Aug 10, 2023

Sorry, can you please elaborate on what you mean by Vault OIDC?

The error you mentioned seems related to a failure when exchanging the authorization code with a token and not really with the Vault/Hashicorp support.

Hashicorp Vault has a OIDC auth method which Keycloak is a one of OIDC provider in Vault.
From what I tested, Keycloak version 22 is unable to use for Vault OIDC auth which thrown out I mentioned error message, after I downgrade Keycloak back to version 20, it works expected.
I am not sure this problem is it belong to Keycloak version 21 removing Hashicorp Vault Support?? I want to know more about Keycloak remove Hashicorp Vault Support is it also affected the OIDC auth?

9 replies

dicky-yuen Aug 21, 2023

Hi @shahneil76, I am not sure if there is my issue or another users also have this problem.

Hi @stefanomarty, good to hear you works, I saw you are using user attributes on KC but I am using groups attributes to map them in Vault with Alias for restriction.
However, I saw someone created a issues on Github which said "Group Membership token mapper adds no claim instead of empty list since Keycloak 22" #22340
In KC22, I logged in Vault via OIDC, and I saw the user cannot get the Clients in Sessions page which showed empty.

shahneil76 Sep 14, 2023

@dicky-yuen Sorry for delayed response, I successfully integrated it and I see session active on Keycloak as well, but on Vault I see this error Vault login failed. Error exchanging oidc code: "Provider.Exchange: id_token failed verification: Provider.VerifyIDToken: invalid id_token audiences: verifyAudiences: invalid id_token audiences: invalid audience".

I think this related to mapping but compare to v15 of Keycloak many things are changed and now it is difficult to figure out.

dicky-yuen Sep 14, 2023

Hi @shahneil76 I tested a lot, and I found out my problem related the client session lifespan. After I set it "inherits from realm settings", it fixed.
For your case, I think you have to verify the configuration like bound_audiences and user_claim

shahneil76 Sep 14, 2023

okay let me try that and will revert back if it worked out, I am also going through each setting and checking the flow once again

swapnil-raj Dec 21, 2023

@dicky-yuen I am still getting this error. my client session lifespan is inherited from realm. Can you help me out?

kingnarmer · 2024-01-31T11:43:22Z

kingnarmer
Jan 31, 2024

I am running into similar issue with vault login , our keycloak running version 20.

0 replies

mrcodecloud · 2024-07-04T13:29:24Z

mrcodecloud
Jul 4, 2024

I was also getting the same above error, which turned out to be due to the wrong client-id value in the role for OIDC
The value for the "bound_audiences" needs to be the client-id, the same we configured for the SSO and mentioned in the OIDC configuration too.

vault write auth/oidc/role/reader \
bound_audiences="keycloak-client-id" \
allowed_redirect_uris="https://vault.example.com/oidc/oidc/callback" \
allowed_redirect_uris="https://vault.example.com/ui/vault/auth/oidc/oidc/callback" \
user_claim="sub" \
policies=reader

0 replies

Removing Hashicorp Support #16446

Uh oh!

Uh oh!

pedroigor Jan 13, 2023 Collaborator

Replies: 4 comments · 10 replies

Uh oh!

Uh oh!

pedroigor Aug 9, 2023 Collaborator Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pedroigor
Jan 13, 2023
Collaborator

Replies: 4 comments 10 replies

pedroigor Aug 9, 2023
Collaborator Author