Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No support for sts client networks in auth backend #117

Open
BlizzTom opened this issue Apr 24, 2024 · 0 comments
Open

No support for sts client networks in auth backend #117

BlizzTom opened this issue Apr 24, 2024 · 0 comments

Comments

@BlizzTom
Copy link

Due to the way that the sts endpoint validation works, if a client is using the vpc endpoints for sts because there is no internet access (intentional), the alicloud auth backend will reject the sts endpoint with the error:

* error making upstream request: expected host of "sts.cn-hangzhou.aliyuncs.com" but received "sts-vpc.cn-hangzhou.aliyuncs.com"

This forces internet access on the Vault server.

The issue lies in this codeset, where the client.Network is not configurable in any way.

https://github.com/hashicorp/vault-plugin-auth-alicloud/blob/main/path_login.go#L258-L284

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant