You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When identityStore is initialized (post-unseal, leadership taken) it does not properly fill the group_alias memDB table.
Since all aliases content are stored in the identity group as well, any update on the group, will correctly save the alias in MemDB.
To Reproduce
#!/bin/bash
export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN=devtoken
function poison_pill
{
pkill -P $$
}
FILE=$(mktemp)
function vault_up
{
vault server -dev -dev-root-token-id="$VAULT_TOKEN" 2>&1 > $FILE &
}
function unseal_key
{
grep 'Unseal Key:' $FILE | awk '{print $3}' | tr -d '\n'
}
function vault_reseal
{
vault operator seal
vault operator unseal $(unseal_key)
}
vault_up
trap poison_pill EXIT
set -e
sleep 1
GROUP_ID=$(vault write -format=json identity/group type=external name=test-group | jq -r '.data.id' | tr -d '\n')
vault auth enable ldap
ACCESSOR=$(vault auth list -format=json | jq -r '.["ldap/"].accessor' | tr -d '\n')
ALIAS_ID=$(vault write -format=json identity/group-alias name=test-alias canonical_id=$GROUP_ID mount_accessor=$ACCESSOR | jq -r '.data.id' | tr -d '\n')
echo "--- LIST ALL ALIASES"
vault list identity/group-alias/id
echo "---------------------"
echo "Resealing Vault"
vault_reseal
sleep 1
echo "--- LIST ALL ALIASES AFTER RE-UNSEAL"
vault list identity/group-alias/id
echo "---------------------"
rm -f "$FILE"
exit 1
Expected behavior
Aliases should get loaded properly
Environment:
Vault Server Version (retrieve with vault status): master ( tested on 0.10 and 0.11 too)
Vault CLI Version (retrieve with vault version): can be made via api calls
Server Operating System/Architecture: all
Additional context
Impacts all backends as it's a functional problem in identityStore, not backend specific layer
The text was updated successfully, but these errors were encountered:
Describe the bug
When identityStore is initialized (post-unseal, leadership taken) it does not properly fill the group_alias memDB table.
Since all aliases content are stored in the identity group as well, any update on the group, will correctly save the alias in MemDB.
To Reproduce
Expected behavior
Aliases should get loaded properly
Environment:
vault status
): master ( tested on 0.10 and 0.11 too)vault version
): can be made via api callsAdditional context
Impacts all backends as it's a functional problem in identityStore, not backend specific layer
The text was updated successfully, but these errors were encountered: