Intermittent error: claim "ref_protected" does not match any associated bound claim values

[hiaik]

Hi Team,

We are on 1.7.1 (https://github.com/hashicorp/vault/blob/main/CHANGELOG-pre-v1.10.md#171) which uses github.com/hashicorp/vault-plugin-auth-jwt v0.9.3

We are on GitLab 16.11.1-ee

We experience intermittent error "claim "ref_protected" does not match any associated bound claim values" which disappears itself with unknown to us conditions.

It seems coming from:

vault-plugin-auth-jwt/claims.go

Line 138 in cb729dd

return fmt.Errorf("claim %q does not match any associated bound claim values", claim)

Role yaml file is:

---
name: app-ci
role_type: jwt
token_policies:
  - app-ci
  - gitlab-runner
token_explicit_max_ttl: 60
user_claim: user_email
bound_claims:
  project_path: <project path in gitlab>
  iss:
    - https://<gitlab url>
    - <gitlab url>
bound_claims_type: string

I have checked both changelogs:

• https://github.com/hashicorp/vault-plugin-auth-jwt/blob/main/CHANGELOG.md
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md

Have not found any related issue.

Still this issue is intermittent on our side. It occurs for pipeline jobs on protected tags / branches. And it disappears itself with no known changes on your side.

Could you please share any guidance?