# Vault & GitLab CI integration using JWT

**URL:** <https://discuss.hashicorp.com/t/vault-gitlab-ci-integration-using-jwt/63079>\
**Category:** Vault\
**Tags:** vault\
**Created:** [February 23, 2024, 7:10am UTC](https://discuss.hashicorp.com/t/vault-gitlab-ci-integration-using-jwt/63079 "2024-02-23T07:10:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anteqkois](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anteqkois](https://discuss.hashicorp.com/u/anteqkois)\
**Post date:** [February 23, 2024, 7:10am UTC](https://discuss.hashicorp.com/t/vault-gitlab-ci-integration-using-jwt/63079/1 "2024-02-23T07:10:50Z")

</div>

I have used an integration with GitLab CI, and all existing works fine. But when I add a new project and want to integrate CI, this error starts occurring:

```auto
{"errors":["error validating token: invalid audience (aud) claim: audience claim does not match any expected audience"]}

```

What we do:

- Added new kv ‘group’

- Added new auth role to policies (gitlab-prod):

```auto
path "kv/scrapper/* " {
  capabilities = ["read"]
 }

```

- execute command to configure role:

```auto
vault write auth/jwt/role/scrapper - <<EOF 
{ 
  "role_type": "jwt", 
  "policies": ["gitlab-prod"], 
  "token_explicit_max_ttl": 60, 
  "bound_claims_type": "glob", 
  "bound_claims": { 
    "project_id": "***", 
    "ref": "prod", 
    "ref_type": "branch" 
  }, 
  "user_claim": "sub", 
  "bound_audiences": "https://gitlab.com" 
} 
EOF

```

- during CI I want to connect with Vault using this way in bash script:

```auto
# Store Vault address, auth role, etc.
VAULT_ADDR="***"
VAULT_AUTH_ROLE="scrapper"
VAULT_SECRETS_PATH="kv/scrapper/data/secrets?version=1"
# path for new keys

# Set Vault Token by Gitlab JWT
VAULT_LOGIN_URL="${VAULT_ADDR}/v1/auth/jwt/login"
VAULT_LOGIN_DATA="{\"role\": \"${VAULT_AUTH_ROLE}\", \"jwt\": \"${CI_JOB_JWT_V2}\"}"
VAULT_LOGIN_OUTPUT=$(curl --request POST --data "${VAULT_LOGIN_DATA}" ${VAULT_LOGIN_URL})
VAULT_TOKEN=$(echo $VAULT_LOGIN_OUTPUT | jq -r ".auth.client_token")
VAULT_TOKEN_HEADER="X-Vault-Token: ${VAULT_TOKEN}"

```

But the login response gives this error:

```auto
{"errors":["error validating token: invalid audience (aud) claim: audience claim does not match any expected audience"]}

```

Probably there is a issue connected to JWT generated by GitLab runner (CI\_JOB\_JWT\_V2), but our previous integrations work fine and use the same way.

---

<div class="post-metadata">

**Author:** ![rtwolfe](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/rtwolfe/32/39999_2.png) [@rtwolfe](https://discuss.hashicorp.com/u/rtwolfe)\
**Post date:** [February 24, 2024, 6:19pm UTC](https://discuss.hashicorp.com/t/vault-gitlab-ci-integration-using-jwt/63079/2 "2024-02-24T18:19:28Z")

</div>

The error indicates a mismatch between the audience (aud) claim in the JWT token from GitLab CI and what’s expected in Vault’s JWT auth role. Check the aud claim in the GitLab JWT token and ensure the Vault auth role’s bound\_audiences matches it exactly. Update the Vault role if necessary to include the correct audience.

---

<div class="post-metadata">

**Author:** ![anteqkois](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@anteqkois](https://discuss.hashicorp.com/u/anteqkois)\
**Post date:** [February 24, 2024, 7:21pm UTC](https://discuss.hashicorp.com/t/vault-gitlab-ci-integration-using-jwt/63079/3 "2024-02-24T19:21:56Z")

</div>

Thanks for response ! Do you know how can I find audience from GitLab JWT? I tried to retrive it from CI but it is masked 😅