diff --git a/changelog/15583.txt b/changelog/15583.txt new file mode 100644 index 000000000..b6cda3168 --- /dev/null +++ b/changelog/15583.txt @@ -0,0 +1,3 @@ +```release-note:bug +core (enterprise): Fix bug where wrapping token lookup does not work within namespaces. +``` diff --git a/vault/logical_system.go b/vault/logical_system.go index 4641a4227..63febcd89 100644 --- a/vault/logical_system.go +++ b/vault/logical_system.go @@ -3404,13 +3404,23 @@ func (b *SystemBackend) handleWrappingLookup(ctx context.Context, req *logical.R return nil, errors.New("token is not a valid unwrap token") } + lookupNS, err := NamespaceByID(ctx, te.NamespaceID, b.Core) + if err != nil { + return nil, err + } + if lookupNS == nil { + return nil, errors.New("token is not from a valid namespace") + } + + lookupCtx := namespace.ContextWithNamespace(ctx, lookupNS) + cubbyReq := &logical.Request{ Operation: logical.ReadOperation, Path: "cubbyhole/wrapinfo", ClientToken: token, } cubbyReq.SetTokenEntry(te) - cubbyResp, err := b.Core.router.Route(ctx, cubbyReq) + cubbyResp, err := b.Core.router.Route(lookupCtx, cubbyReq) if err != nil { return nil, fmt.Errorf("error looking up wrapping information: %w", err) }