# Azure AD auth: user & programmatic access

**URL:** <https://discuss.hashicorp.com/t/azure-ad-auth-user-programmatic-access/67037>\
**Category:** Vault\
**Created:** [May 15, 2024, 7:27pm UTC](https://discuss.hashicorp.com/t/azure-ad-auth-user-programmatic-access/67037 "2024-05-15T19:27:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ward.cornette](https://avatars.discourse-cdn.com/v4/letter/w/8edcca/32.png) [@ward.cornette](https://discuss.hashicorp.com/u/ward.cornette)\
**Post date:** [May 15, 2024, 7:27pm UTC](https://discuss.hashicorp.com/t/azure-ad-auth-user-programmatic-access/67037/1 "2024-05-15T19:27:10Z")

</div>

I have successfully deployed the vault with OIDC auth using Azure AD. Therefore I set the following config using terraform:

```auto
data "external" "env" {
  program = ["/app/env.sh"]
}
provider "vault" {
  address = "http://localhost:8200"
  token = data.external.env.result["VAULT_TOKEN"]
}

resource "vault_jwt_auth_backend" "oidc" {
  type = "oidc"
  path = "oidc"
  oidc_discovery_url = format("https://login.microsoftonline.com/%s/v2.0", data.external.env.result["AZURE_TENANT_ID"])
  oidc_client_id = data.external.env.result["AZURE_CLIENT_ID"]
  oidc_client_secret = data.external.env.result["AZURE_CLIENT_SECRET"]
  bound_issuer = "https://login.microsoftonline.com"
  default_role = "oidc"

  lifecycle {
    prevent_destroy = false
  }
}

resource "vault_jwt_auth_backend_role" "oidc_user" {
  backend = vault_jwt_auth_backend.oidc.path
  role_name = "oidc"
  token_policies = ["default", "nx-dev"]
  bound_audiences = [data.external.env.result["AZURE_CLIENT_ID"]]

  user_claim = "oid"
  role_type = "oidc"
  allowed_redirect_uris = ["http://localhost:8250/oidc/callback", 
                            "http://localhost:8200/ui/vault/auth/oidc/oidc/callback"
                            ]
  # groups_claim = "roles"
  oidc_scopes = ["https://graph.microsoft.com/.default", "profile", "email"]

  verbose_oidc_logging = true
}

```

Having access to the Web UI, now I also want to access the vault from a Python script. I already have the generation of an AccessToken using msal.ConfidentialClientApplication and acquire\_token\_for\_client(). However, I fail to use this token to access the secrets in the vault…

I enabled jwt logon with a jwt role as follows:

```auto
resource "vault_jwt_auth_backend" "jwt" {
  type = "jwt"
  path = "jwt"
  oidc_discovery_url = format("https://login.microsoftonline.com/%s/v2.0", data.external.env.result["AZURE_TENANT_ID"])
  oidc_client_id = data.external.env.result["AZURE_CLIENT_ID"]
  oidc_client_secret = data.external.env.result["AZURE_CLIENT_SECRET"]
  bound_issuer = format("https://login.microsoftonline.com/%s/v2.0", data.external.env.result["AZURE_TENANT_ID"])
  default_role = "jwt"

  lifecycle {
    prevent_destroy = false
  }
}

resource "vault_jwt_auth_backend_role" "oidc_application" {
  backend = vault_jwt_auth_backend.jwt.path
  role_name = "jwt"
  token_policies = ["default", "nx-dev"]
  bound_audiences = [data.external.env.result["AZURE_CLIENT_ID"]]

  user_claim = "oid"
  role_type = "jwt"
  # groups_claim = "roles"
  oidc_scopes = ["https://graph.microsoft.com/.default", "profile", "email"]

  verbose_oidc_logging = true
}

```

The python script below produces error: “error configuring token validator: unsupported config type”

```auto
client = hvac.Client(
    url=VAULT_SERVER, 
    verify=False
    )

auth_oidc: OIDC = client.auth.oidc
auth_result = auth_oidc.jwt_login(
    role='jwt',
    jwt=access_token, 
    path='jwt'
)

```

How can I fix this ? Thanks in advance !