upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

clarify the JWT auth bound_audiences change in behaviour (#27541)

Browse source
This commit is contained in:
Adrian Todorov 2024-06-19 15:56:45 +02:00 committed by GitHub
parent ab08d623e8
commit e7f2107b52
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
website/content/docs/upgrading/upgrade-to-1.17.x.mdx
View file

@ -70,7 +70,8 @@ The beta request limiter will be removed from Vault entirely in a later release.
### JWT auth login requires bound audiences on the role
The `bound_audiences` parameter of "jwt" roles **must** match at least one of
The `bound_audiences` parameter of "jwt" roles is **mandatory** if the JWT contains an audience
(which is more often than not the case), and **must** match at least one of
the JWT's associated `aud` claims. The `aud` claim claim can be a single string
or a list of strings as per [RFC 7519 Section 4.1.3](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3).
If the JWT's `aud` claim is not set, then the role's `bound_audiences`

4
website/content/partials/known-issues/1_16-jwt_auth_bound_audiences.mdx
View file

@ -14,8 +14,8 @@ the versions after 1.15.10 and 1.16.4. However, the behavior change will go
into effect in 1.17.
The new behavior requires that the `bound_audiences` parameter of "jwt" roles
**must** match at least one of the JWT's associated `aud` claims. The `aud`
claim can be a single string or a list of strings as per
**must** be set and **must** match at least one of the JWT's associated `aud` claims if there are any.
The `aud` claim can be a single string or a list of strings as per
[RFC 7519 Section 4.1.3](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3).
Users may not be able to log into Vault if the JWT role is configured