Configuring a dex oidc auth provider

Vault
1

Hi, i’m trying to configure vault so that it can authenticate with my local dex deployment. i have dex configured at

https://dex-dev.mysite.com/

and the openid-configuration file at

https://dex-dev.mysite.com/.well-known/openid-configuration

i have gangway configured and working, so i’m pretty sure everything is good on the dex side. i configure dex with a client for vault:

staticClients:
- id: vault-client
  redirectURIs:
  - 'https://vault.mysite.com/ui/vault/auth/oidc/oidc/callback'
  name: vault-client
  secret: <string>

i am able to curl https://vault.mysite.com/ui/vault/auth/oidc/oidc/callback.

i then attempt to configure vault with

vault auth enable oidc
vault write auth/oidc/config -<<"EOH"
{
  "oidc_client_id": "vault-client",
  "oidc_client_secret": "<string>",
  "default_role": "default",
  "oidc_discovery_url": "https://dex-dev.mysite.com/.well-known/openid-configuration"
}
EOH

however, it spits out the following:

Error writing data to auth/oidc/config: Error making API request.

URL: PUT https://vault.mysite.com/v1/auth/oidc/config
Code: 400. Errors:

* error checking oidc discovery URL: error creating provider with given values: NewProvider: unable to create provider: 404 Not Found: 404 page not found

can anyone point me to what i’m doing wrong?

2

Up please, having the same question

3

if you figure it out, could you let me know ?

4

The issue is with trailing slash in url

5

No, actually the issue is not with trailing slashes, but rather that the oidc_discovery_url setting, rather confusingly, needs to be supplied without the trailing /.well-known/openid-configuration, as this will be appended to whatever is passed.

1 Like