java - Harshicorp Vault OIDC Authentication via Proxy to Azure AD: 'Invalid Issuer' Error - Stack Overflow

admin管理员组

文章数量:1346968

​I am currently facing challenges while configuring HashiCorp Vault to authenticate via OpenID Connect (OIDC) through a proxy that interfaces with Azure Active Directory (AAD). The proxy exposes the discovery URL, and Vault communicates with it using OIDC. However, after exchanging the authorization code for a token, Vault returns the following error on vault UI:

Vault login failed. Error exchanging oidc code: "Provider.Exchange: id_token failed verification: Provider.VerifyIDToken: invalid id_token: oidc: id token issued by a different provider, expected \"http://{proxy_ip}:443\" got \"/{tenant-id}/v2.0\": invalid issuer".

Modifying the issuer in the discovery URL to match the token's actual issuer leads to another error:

error checking oidc discovery URL: error="error creating provider with given values: NewProvider: unable to create provider: oidc: issuer did not match the issuer returned by provider, expected \"http://{proxy_ip}\" got \"/{tenant-id}/v2.0\"".

I am using Vault version 1.19.0 (7eeafb6160d60ede73c1d95566b0c8ea54f3cb5a), running in development mode locally.​

Has anyone encountered similar issues when configuring Vault with a proxy for Azure AD authentication? Any insights or recommendations would be greatly appreciated.

本文标签： javaHarshicorp Vault OIDC Authentication via Proxy to Azure AD 39Invalid Issuer39 ErrorStack Overflow