Hi, so i have read through this question - where the solution/pre-condition is to add additional meta data. In my case though, I dont think i need any meta data. In my use case, I will be auth’ing using approle - and the common name of the issued cert can/should match the approle name.
Can anyone advice what the allowed_domains template for the role should be?? I have tried various combinations, but keep getting 400 / common name X not allowed by this role errors.
The below should work as an end-to-end script - using docker - to show the error. The pki_int.hcl file is also provided. Thanks!
#!/bin/sh
set -o xtrace
# start vault
docker stop vault-demo-vault
docker rm vault-demo-vault
location=$(pwd)
docker run --name vault-demo-vault -v ${location}/log:/var/log \
--network dev-network -p 8200:8200 hashicorp/vault:1.14.8 \
server -dev -dev-root-token-id="root" &
sleep 5
# setup pki
export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN=root
export VAULT_NAMESPACE=
vault secrets disable pki_int
vault secrets enable -path=pki_int pki
vault write "pki_int/root/generate/internal" \
common_name="Test CA" \
ttl=365d
# setup pki role
vault write "pki_int/roles/example" \
ttl=24h \
allowed_domains={{identity.entity.alias.metadata.role_name}} \
# tried allowed_domains='{{identity.entity.name}}' \
# tried allowed_domains='{{identity.entity.alias.name}}' \
# tried allowed_domains='{{identity.entity.metadata.role}}' \
# tried allowed_domains='{{identity.entity.alias.metadata.role}}' \
# tried allowed_domains='{{identity.entity.metadata.role_name}}' \
# tried allowed_domains='{{identity.entity.alias.metadata.role_name}}' \
allowed_domains_template=true \
allow_bare_domains=true
#create a new policy to create update revoke and list certificates
vault policy write pki_int pki_int.hcl
# create app role
vault auth enable approle
vault write auth/approle/role/my-damo-role \
secret_id_ttl=10m \
token_num_uses=10 \
token_policies="pki_int"
APPROLE_ROLE_ID=$(vault read auth/approle/role/my-damo-role/role-id | awk '/role_id/ {print $2}')
APPROLE_SECRET_ID=$(vault write -f auth/approle/role/my-damo-role/secret-id | awk '$1 == "secret_id" {print $2}')
unset VAULT_TOKEN
vault write auth/approle/login \
role_id=${APPROLE_ROLE_ID} \
secret_id=${APPROLE_SECRET_ID} | awk '$1 == "token" {print $2}' > approle.token
export VAULT_TOKEN=`cat approle.token`
echo "VAULT_TOKEN: " $VAULT_TOKEN
vault write -format=json "pki_int/issue/example" \
common_name=my-damo-role \
> generated_example.cert.json
pki_int.hcl
path "pki_int/issue/*" {
capabilities = ["create", "update"]
}
path "pki_int/certs" {
capabilities = ["list"]
}
path "pki_int/revoke" {
capabilities = ["create", "update"]
}
path "pki_int/tidy" {
capabilities = ["create", "update"]
}
path "pki/cert/ca" {
capabilities = ["read"]
}
path "auth/token/renew" {
capabilities = ["update"]
}
path "auth/token/renew-self" {
capabilities = ["update"]
}
