Is there a way to disable the jwks validation check when its configured?

Vault
1

We are planning to use the JWT auth method to authenticate with Vault, but we are running into an issue when trying to configure the jwt auth configuration on the Vault side. Our jwks url will not and cannot be running at the time we need to configure it. However, it seems like when we attempt to configure the jwks url, Vault attempts to make a request to the url (which in our case is not up) so the config operation fails with the output pasted below. Our jwks url will be up and running at the time we need to authenticate, so is there a way to disable this reachability check?

vault write auth/jwt/config jwks_url="http://127.0.0.1:9080/jwt/api/vaultAuth/jwk" bound_issuer="iss" default_role="role"

Error writing data to auth/jwt/config: Error making API request.



URL: PUT https://127.0.0.1:8200/v1/auth/jwt/config

Code: 400. Errors:



* error checking jwks URL http://127.0.0.1:9080/jwt/api/vaultAuth/jwk
2

I’ve seen a post mention this property disable_jwks_validation=true which I tried but does not seem to work.

vault write auth/jwt/config jwks_url="http://127.0.0.1:9080/jwt/api/vaultAuth/jwk" bound_issuer="iss" default_role="role" disable_jwks_validation=true 
Error writing data to auth/jwt/config: Error making API request.

URL: PUT https://127.0.0.1:8200/v1/auth/jwt/config
Code: 400. Errors:

* error checking jwks URL http://127.0.0.1:9080/jwt/api/vaultAuth/jwk
3

Why is the jwks url not up when configuring it?
If not, checking the documentation, you could use jwt_validation_pubkeys with the issuer’s public key.

4

In our JWT implementation, the runtime automatically creates the RSA private and public key pair completely in-memory as our software starts up, the jwks url then gets put up with our public key. After this happens we want to authenticate with Vault to start using the secrets stored inside as the rest of our software continues to start.

Because of that order of operations we can’t use jwt_validation_pubkeys since that gets created on startup. We want to use the jwks url for this purpose but that requires it to be configured in Vault before our software starts. We were hoping that theres a way to disable the reachability check it does since the jwks url will be up and running when we need to authenticate.

5

Could you publish the public portion of the jwks file? Something like:

6

Sadly this doesn’t solve our problem, as the JWT and JWKS are all generated as our software is starting, which we then need to authenticate with Vault right after. So we need to have Vault configured to accept these generated JWT and JWKS before we start our software.

As long as Vault validates the JWKS url is up and running at the time it gets configured, we are left with the same issue.