Okta auth backend doesn't respect its own max_ttl

[white-glider]

Environment:

• Vault Version: 0.9.5
• Operating System/Architecture: linux_amd64

Vault Config File:

storage "file" {
  path = "/opt/vault/storage"
}
listener "tcp" {
  address         = "0.0.0.0:8200"
  tls_cert_file   = "/opt/vault/config/vault.crt"
  tls_key_file    = "/opt/vault/config/vault.key"
}

Startup Log Output:

==> Vault server configuration:

                     Cgo: disabled
              Listener 1: tcp (addr: "0.0.0.0:8200", cluster address: "0.0.0.0:8201", tls: "enabled")
               Log Level: info
                   Mlock: supported: true, enabled: true
                 Storage: file
                 Version: Vault v0.9.5
             Version Sha: 36edb4d42380d89a897e7f633046423240b710d9

==> Vault server started! Log data will stream in below:

Expected Behavior:

After enabling and configuring Okta auth backend with max_ttl different than zero, without changing the default_lease_ttl and the max_lease_ttl, any successfully authenticated user should get a token with a duration <= max_ttl.

Actual Behavior:

Successfully authenticated users get a token with duration = 768h, although Okta backend was configured with max_ttl=1h.

Steps to Reproduce:

1. Enable Okta auth backend
2. Configure Okta auth backend with max_ttl=1h
3. Authenticate to Vault through Okta
4. Look for the token_duration line in Vault's output

Important Factoids:

If Okta auth backend is configured with both max_ttl=1h and ttl=1h then token's duration is limited to 1h.

[white-glider]

After b3c9358 now Okta respects max_ttl=1h, but I get the following weird warning after a successful login (using Vault 0.9.6):

WARNING! The following warnings were returned from Vault:

  * Effective TTL of '1h0m0s' exceeded the effective max_ttl of '1h0m0s'; TTL
  value is capped accordingly

Configuration is still the same like explained in the ticket, i.e.:

$ vault read auth/okta/config
Key                Value
---                -----
bypass_okta_mfa    false
max_ttl            3600
org_name           whatever
organization       whatever
ttl                0