# Vault SSH CA can't get allowed\_users\_template to work

**URL:** <https://discuss.hashicorp.com/t/vault-ssh-ca-cant-get-allowed-users-template-to-work/34810>\
**Category:** Vault\
**Tags:** vault\
**Created:** [January 26, 2022, 9:27am UTC](https://discuss.hashicorp.com/t/vault-ssh-ca-cant-get-allowed-users-template-to-work/34810 "2022-01-26T09:27:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewToVault](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/newtovault/32/23944_2.png) [@NewToVault](https://discuss.hashicorp.com/u/NewToVault)\
**Post date:** [January 26, 2022, 9:27am UTC](https://discuss.hashicorp.com/t/vault-ssh-ca-cant-get-allowed-users-template-to-work/34810/1 "2022-01-26T09:27:59Z")

</div>

I’m trying to set up ssh ca public key signing. And I need the user name to be set as principal. I tried to enable templates for allowed\_users with allowed\_users\_template: true but I only get error messages. Any help appreciated.  
(it works without templates)

To reproduce:

> vault write ssh-client-signer/roles/test -\<\<EOH  
> {  
> “allow\_user\_certificates”: true,  
> “allowed\_users”: “root,{{identity.entity.metadata.shortname}}”,  
> “allowed\_users\_template”: true,  
> “allowed\_extensions”: “”,  
> “default\_extensions”: [  
> {  
> “permit-pty”: “”  
> }  
> ],  
> “key\_type”: “ca”,  
> “ttl”: “30m0s”  
> }  
> EOH  
> Success! Data written to: ssh-client-signer/roles/test  
> vault write -field=signed\_key ssh-client-signer/sign/test public\_key=@.ssh/alice-key.pub valid\_principals=alice \> .ssh/alice-signed-key.pub  
> Error writing data to ssh-client-signer/sign/test: Error making API request.  
> URL: PUT [https://127.0.0.1:8200/v1/ssh-client-signer/sign/test](https://127.0.0.1:8200/v1/ssh-client-signer/sign/test)  
> Code: 400. Errors:

- alice is not a valid value for valid\_principals

> vault write ssh-client-signer/roles/test -\<\<EOH  
> {  
> “allow\_user\_certificates”: true,  
> “allowed\_users”: “{{identity.entity.metadata.shortname}}”,  
> “allowed\_users\_template”: true,  
> “allowed\_extensions”: “”,  
> “default\_extensions”: [  
> {  
> “permit-pty”: “”  
> }  
> ],  
> “key\_type”: “ca”,  
> “ttl”: “30m0s”  
> }  
> EOH  
> Success! Data written to: ssh-client-signer/roles/test  
> vault write -field=signed\_key ssh-client-signer/sign/test public\_key=@.ssh/alice-key.pub valid\_principals=alice \> .ssh/alice-signed-key.pub  
> Error writing data to ssh-client-signer/sign/test: Error making API request.  
> URL: PUT [https://127.0.0.1:8200/v1/ssh-client-signer/sign/test](https://127.0.0.1:8200/v1/ssh-client-signer/sign/test)  
> Code: 400. Errors:

- role is not configured to allow any principals

Vault Version 1.6.1

---

<div class="post-metadata">

**Author:** ![jeffsanicola](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffsanicola/32/18651_2.png) [@jeffsanicola](https://discuss.hashicorp.com/u/jeffsanicola)\
**Post date:** [January 26, 2022, 2:26pm UTC](https://discuss.hashicorp.com/t/vault-ssh-ca-cant-get-allowed-users-template-to-work/34810/2 "2022-01-26T14:26:05Z")

</div>

There looks to be a fix/improvement for templated users in SSH configs within Vault 1.9.0. I would suggest trying on the current version (1.9.2) to see if your issue persists.

> <https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#190>

> <https://github.com/hashicorp/vault/pull/10886>
>
> As outlined in #10388 the regex checking for templates tags in \_allowed\_users\_ w…hen signing SSH certs could be more liberal. By removing \`^\` and \`$\` templates like \`username-{{ identity.entity.name }}\` are also allowed.

---

<div class="post-metadata">

**Author:** ![NewToVault](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/newtovault/32/23944_2.png) [@NewToVault](https://discuss.hashicorp.com/u/NewToVault)\
**Post date:** [January 27, 2022, 10:10am UTC](https://discuss.hashicorp.com/t/vault-ssh-ca-cant-get-allowed-users-template-to-work/34810/3 "2022-01-27T10:10:06Z")

</div>

Thank you very much. It was really a bug in the version I used. Switching to the new version and everything worked fine.