Removing Hashicorp Support

[pedroigor]

We are planning to remove the out-of-box Hashicorp support for the following reasons:

• After long discussions around supportability, we can not guarantee the proper level of support for quarkus-vault-extension, mainly in terms of security and potential CVEs.
• We did not receive much feedback from the community or at least not as much as we want to justify supporting the capability. There are well-known issues associated with it like its very bad UX and limitations on the type of secrets that can be resolved from a vault
• The project is working on a tool to install/remove Quarkus extensions from the distribution, making it possible to leverage the whole Quarkus ecosystem including Hashicorp support.
• We are reviewing vault support as per Quarkus File Vault integration #15831.
• It will unblock critical paths in our roadmap like slimming down the distribution to reduce its size even further. See Remove any unnecessary dependency from distribution #9075.

You can follow the work being done at #9144.

[dicky-yuen]

Hi @pedroigor
I upgraded my Keycloak to version 22, and my Vault OIDC authentication is thrown out below error message.
" Vault login failed. Error exchanging oidc code: "Provider.Exchange: unable to exchange auth code with provider: oauth2: cannot fetch token: 400 Bad Request\nResponse: {"error":"invalid_grant","error_description":"Code not valid"}"."*

Can I confirm Keycloak is also no longer support Vault OIDC logging in future release?

[pedroigor]

Sorry, can you please elaborate on what you mean by Vault OIDC?

The error you mentioned seems related to a failure when exchanging the authorization code with a token and not really with the Vault/Hashicorp support.

[dicky-yuen]

Sorry, can you please elaborate on what you mean by Vault OIDC?

The error you mentioned seems related to a failure when exchanging the authorization code with a token and not really with the Vault/Hashicorp support.

Hashicorp Vault has a OIDC auth method which Keycloak is a one of OIDC provider in Vault.
From what I tested, Keycloak version 22 is unable to use for Vault OIDC auth which thrown out I mentioned error message, after I downgrade Keycloak back to version 20, it works expected.
I am not sure this problem is it belong to Keycloak version 21 removing Hashicorp Vault Support?? I want to know more about Keycloak remove Hashicorp Vault Support is it also affected the OIDC auth?

[dicky-yuen]

Hi @shahneil76, I am not sure if there is my issue or another users also have this problem.

Hi @stefanomarty, good to hear you works, I saw you are using user attributes on KC but I am using groups attributes to map them in Vault with Alias for restriction.
However, I saw someone created a issues on Github which said "Group Membership token mapper adds no claim instead of empty list since Keycloak 22" #22340
In KC22, I logged in Vault via OIDC, and I saw the user cannot get the Clients in Sessions page which showed empty.

[shahneil76]

@dicky-yuen Sorry for delayed response, I successfully integrated it and I see session active on Keycloak as well, but on Vault I see this error Vault login failed. Error exchanging oidc code: "Provider.Exchange: id_token failed verification: Provider.VerifyIDToken: invalid id_token audiences: verifyAudiences: invalid id_token audiences: invalid audience".

I think this related to mapping but compare to v15 of Keycloak many things are changed and now it is difficult to figure out.

[dicky-yuen]

Hi @shahneil76 I tested a lot, and I found out my problem related the client session lifespan. After I set it "inherits from realm settings", it fixed.
For your case, I think you have to verify the configuration like bound_audiences and user_claim

[shahneil76]

okay let me try that and will revert back if it worked out, I am also going through each setting and checking the flow once again

[swapnil-raj]

@dicky-yuen I am still getting this error. my client session lifespan is inherited from realm. Can you help me out?

[kingnarmer]

I am running into similar issue with vault login , our keycloak running version 20.

[mrcodecloud]

I was also getting the same above error, which turned out to be due to the wrong client-id value in the role for OIDC
The value for the "bound_audiences" needs to be the client-id, the same we configured for the SSO and mentioned in the OIDC configuration too.

vault write auth/oidc/role/reader \
bound_audiences="keycloak-client-id" \
allowed_redirect_uris="https://vault.example.com/oidc/oidc/callback" \
allowed_redirect_uris="https://vault.example.com/ui/vault/auth/oidc/oidc/callback" \
user_claim="sub" \
policies=reader