-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
lookup/hashi_vault.py: IAM auth does not support the mount_point
parameter
#7
Comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Thanks for this report @lamawithonel ! Are you interested in putting in a PR for this? If not, it's something I will likely address myself but not sure of timeframe just yet. |
Hi @briantist . Thanks! :) |
@briantist I can get something together later this month. Does it need tests? |
@ichasco this is a bug report but not a PR so there's no change to be applied just yet. Someone has to work to implement the change @lamawithonel thanks that'd be great. Unfortunately we don't have tests for this auth method since it's difficult to set up what is needed on the AWS side (for me anyway) in the test environment. It might make sense to add some basic tests that ensure the parameters are being used/accepted correctly? Not sure if that'll be possible though. |
Hi @lamawithonel, just FYI we've moved this isssue to https://github.com/ansible-collections/community.hashi_vault |
SUMMARY
AWS IAM authentication does not take the
mount_point
parameter, but other auth methods do.ISSUE TYPE
A previous report of a similar issue (#767) was classified as a Bug.
COMPONENT NAME
lookup/hashi_vault.py
ANSIBLE VERSION
CONFIGURATION
No changes
OS / ENVIRONMENT
STEPS TO REPRODUCE
obfuscated-iam
.hash_vault
lookup plugin with the optionsauth_method=aws_iam_login mount_point=obfuscated-iam
EXPECTED RESULTS
hashi_vault
should authenticate successfully to Vault using the custom mountpoint.The issue resides, or at least is fixable, in the
validate_auth_aws_iam_login
function, here. A naive fix is to addmount_point
to theparams
list as below:ACTUAL RESULTS
hashi_vault
attempts to authenticate using the defaultaws
mountpoint instead of the requestedobfuscated-iam
, i.e.,/v1/auth/aws/login
instead of/v1/auth/obfuscated-iam/login
.The text was updated successfully, but these errors were encountered: