Repository navigation
Permission denied on /sys/wrapping/rewrap endpoint #17507
Description
Hi, Vault team.
I've forked vault-java-driver to fix unwrap and add wrap/rewrap functions.
The wrap/unwrap work perfectly, but /sys/wrapping/rewrap always response:
Code: 403
Body: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}
I've tried to put wrapped token to body, or X-Vault-Token header but the response is the same.
I try to modify approlePolicy.hcl and implicit specify all rights for the path sys/wrapping/rewrap - response not changed.
I hope this is not a Vault bug, but a misconfiguration or invalid HTTP request (but I follow the API docs).
- Vault Version: any version (checked on 1.1.3. 1.7.0, 1.11.4);
- Vault Config Files:
config.json
approlePolicy.hcl
Please any comment or suggestions.
Activity
tledkov commentedon Oct 14, 2022
Hi Vault team.
My apologize for the incomplete / wrong description of the issue.
Adding permissions (create new role and assign one to user) for
/sys/wrapping/rewrapendpoint solved the problem.I was wrong when i wrote about modify policy. The policy setting was not correct.
BUT. It is not clear for me why all
/sys/wrapping/*endpoints are allowed by thedefaultpolicy, except for the/sys/wrapping/rewrapendpoint. This fact is not described (or not highlight) at the documentation.Looks like the default policies have been modified or documentation should be improved.
Sorry for trouble, if I wrong again.