vault icon indicating copy to clipboard operation
vault copied to clipboard

Identity group should support multiple aliases - as entity does

Open maxenced opened this issue 1 year ago • 0 comments

Describe the bug

Identity groups only support a single alias per group, which makes an extra overhead when providing multiple auth source which all uses the same IdP at the end (one ldap and one oidc for ex). Right now, providing two identity group alias with same name but different mount accessor will only keep the latest.

To Reproduce Steps to reproduce the behavior:

$ vault write identity/group-alias name=MyGroup mount_accessor=auth_oidc_6b9ba80d canonical_id=e1f10bdb-c22a-f42c-e188-a9c005e3fef1v
$ vault read identity/group-alias/id/xxxx < id from previous command output, OK
$ vault write identity/group-alias name=MyGroup mount_accessor=auth_jwt_65f53ce1 canonical_id=e1f10bdb-c22a-f42c-e188-a9c005e3fef1  # same canonical id, different mount_accessors
$ vault read identity/group-alias/id/yyyyy < id from previous command, OK
$ vault read identity/group-alias/id/xxxx < id from first command >> KO, doesn't exist anymore  <<

Expected behavior Entity already support multiple aliases, Group should have the same behaviour and allow multiple aliases with same name but different mount accessors (so, auth source).

Environment:

  • Vault Server Version (retrieve with vault status): 1.14.5
  • Vault CLI Version (retrieve with vault version): 1.15.4
  • Server Operating System/Architecture: docker images

maxenced avatar Dec 14 '23 13:12 maxenced