* UI/OIDC: allow passing namespace in state
Suppport in the UI OIDC callback flow to parse namespace out of the
state parameter instead of a separate query parameter in the
redirect_uri. Includes docs for the option that enables this behavior
in the JWT plugin.
* 1.6 wordsmithing
* pass_namespace_in_state -> namespace_in_state
* re-wording
* use strict equals
Co-authored-by: Vishal Nayak <vishalnayak@users.noreply.github.com>
* strip redundant field type declarations
* root credential rotation for aws creds plugin
* Change location of mocks awsutil and update methods that no longer exist
* Update website/pages/docs/auth/aws.mdx
Co-authored-by: Calvin Leung Huang <cleung2010@gmail.com>
* Update sdk version to get the awsutil mock file
* Re-vendor modules to pass CI
* Use write lock for the entirety of AWS root cred rotation
* Update docs for AWS root cred rotation for clarity
Co-authored-by: Becca Petrin <beccapetrin@gmail.com>
Co-authored-by: Calvin Leung Huang <cleung2010@gmail.com>
* TLS Cert Authentication example updates
- Updated the Cert Auth example description to clarify which CA
should issue the certificate.
- Removed `-ca-cert` parameter from examples as this caused
confusion. Is this the auth CA or the CA of the listener?
* Return CA parameter to examples, add Note
- Returned CA parameter to login examples
- Added note above examples to explain which CA is being used in CLI
- Updated examples in API doc to use httpS
- Added note above login example to explain wich CA is being used
Co-authored-by: Calvin Leung Huang <cleung2010@gmail.com>
* docs: adds documentation for JWT/OIDC google provider specific handling
* use may instead of will for identity group alias association
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
* adds missed parentheses
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
* adds missed parentheses
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
* reword sentence referring to key file for Google service account
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
* add styles to emphasize security step
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
* Add specification about AWS IAM Unique Identifiers
We experienced an issue where IAM roles resources were re-provisioned with the same ARNs and no change had been made to our vault role configuration but users lost access with `-method=aws`. It wasn't immediately clear to us how IAM Unique Identifiers where being used to avoid the same situations outlined in the AWS documentation. We eventually concluded that re-provisioning the roles in our auth/aws/auth would fetch the new IAM Unique Identifiers.
I hope that this small amendment helps people avoid this problem in the future.
Upgrade to new official Okta sdk lib. Since it requires an API token, use old unofficial okta lib for no-apitoken case.
Update test to use newer field names. Remove obsolete test invalidated by #4798. Properly handle case where an error was expected and didn't occur.
