vault
vault copied to clipboard
Identity group should support multiple aliases - as entity does
Describe the bug
Identity groups only support a single alias per group, which makes an extra overhead when providing multiple auth source which all uses the same IdP at the end (one ldap and one oidc for ex). Right now, providing two identity group alias with same name but different mount accessor will only keep the latest.
To Reproduce Steps to reproduce the behavior:
$ vault write identity/group-alias name=MyGroup mount_accessor=auth_oidc_6b9ba80d canonical_id=e1f10bdb-c22a-f42c-e188-a9c005e3fef1v
$ vault read identity/group-alias/id/xxxx < id from previous command output, OK
$ vault write identity/group-alias name=MyGroup mount_accessor=auth_jwt_65f53ce1 canonical_id=e1f10bdb-c22a-f42c-e188-a9c005e3fef1 # same canonical id, different mount_accessors
$ vault read identity/group-alias/id/yyyyy < id from previous command, OK
$ vault read identity/group-alias/id/xxxx < id from first command >> KO, doesn't exist anymore <<
Expected behavior Entity already support multiple aliases, Group should have the same behaviour and allow multiple aliases with same name but different mount accessors (so, auth source).
Environment:
- Vault Server Version (retrieve with
vault status
): 1.14.5 - Vault CLI Version (retrieve with
vault version
): 1.15.4 - Server Operating System/Architecture: docker images