Vault oidc login - multiple roles, one login, one token

Vault
1

Hello!

In my setup, I am using Vault with OIDC method enabled against Azure AD, where I use groups to control which user is allowed to use which oidc role - I am using bound claims to check AD group. One user could be member of multiple groups, so he could use multiple OIDC roles.

Generic vault auth help oidc command outputs:
Usage: vault login -method=oidc [CONFIG K=V…]

role=
Vault role of type “OIDC” to use for authentication.

I tried using

vault login -method=oidc role=other-rw role=core-rw

but I am getting following error:
Error parsing configuration: failed to convert values to strings: 1 error(s) decoding:

  • ‘[role]’ expected type ‘string’, got unconvertible type ‘interface {}’

I am using vault 1.9.3

2

I’m not using OIDC so this may be incorrect, but my guess is that you can’t request multiple roles. I believe you “can” setup a default_role when you setup the auth then add an the “other-rw” role when logging in. This is a guess though.

3

Hi! yes, I suspect this is the case, but I can see no reason why it shouldn’t work. Of course I can be wrong but the manual says [ K=V ] which seems to me that multiple key/value pairs can be passed over.

The thing with my setup is that I would like to control access to secrets via AD group membership.

  • one AD group represents a set of projects/databases
  • one user can be member of multiple groups - for example advanced developer who has access to multiple projects is member of multiple groups
  • I would like those people to get a single token from vault after login, where all their roles
    (and therefore policies) are accumulated,

I guess other options are:

  1. create AD groups for all necesary combinations of access permissions (for example if I have sets of projects A, B and C, I would need to create groups A (for users that access only A projects), AB (for users that access projects A and B), AC (for users that access projects A and C) and so on)
  2. create helper script that would keep multiple login tokens for a user - one for each role and keep this structured for all users at all times.

Both of these solutions seems a bit overcomplicated compared to just get all roles in one login / token.

4

Hi!

This is very much possible. However perhaps not in approach of “roles”. The setup that I am familiar with is using “external groups”.

  1. Setup OIDC auth method with a default role and connect it to your application. This role should only be used to perform login operations.
  2. You define external groups that have an alias linked to the AD group object ID
  3. When logging in with OIDC an entity is created over at Vault which then automatically also automatically recognises the external groups
  4. These external groups are then linked to an internal group which contain the policies

This approach doesn’t require your users to remember their roles, but are automatically managed by the administrator team and Azure AD.

An example tutorial that has this approach: Azure Active Directory with OIDC Auth Method and External Groups | Vault - HashiCorp Learn.

1 Like
5

Hello,

just to let everybody know:

initialy (before I even started this thread) I tried the setup you mentioned - the azure ad with external groups example tutorial, but it was not working well for me. That’s why I ended up trying the role approach.

After some time spent with debug, I found out, that (after I followed the tutorial) AD was not sending group information that would contain group names (displayName in AD) but it was sending uuid (azure object ids) so I had to create Vault groups with names as AD groups ids.

After that, vault started to assign entities to correct groups.

2 Likes
6

Hello @hyzza,

I’m facing with the same question regarding , what if the same user are in multiple groups with multiple role assignments.
Could you explain in a bit more details how did you solved the question?

So if you log in now with the user who is a member of multiple groups, the group permissions are appended?

I also followed the guide here ( Azure Active Directory with OIDC Auth Method and External Groups | Vault | HashiCorp Developer )

7

Hi @tothger ,

I believe you have been misled by the very generic English word “role” being used to mean differenent things in different areas of computer security.

A “role” in Vault means a “configuration profile”. It does NOT map onto groups, nor does it have anything to do with roles as in “Role Based Access Control”.

Almost all users of the Vault OIDC auth method should define exactly one role only.

I would suggest naming that role default, and setting it as the default role in the OIDC auth method config, so that users don’t even need to know the name of the role.

Should you have further questions, I would encourage you to start a new forum topic, rather than resurrecting one from over a year ago. This gives you a place to clearly present your own questions, and means that potential responders don’t need to read a lot of previous messages that may or may not be relevant.

8

Dear @maxb ,
Sorry, My interpretation was wrong.
My question is.

I have an user called “Foo”
He is member in 2 groups in AD. “Password_reader_A” and “Password_reader_B”.
Both AD Groups has a group alias and a role in the Vault. 1-1.
If I login with the user Foo. Which group will be used if I not choose a role in the login?

9

I think you have not understood what I wrote before.

Groups, and Vault OIDC auth method roles, have nothing to do with each other.

11

Hello @maxb .
Finally I realized where I misunderstood the topic. Now it works pretty well :smiley:
Thank you for the explanations