harald/vault-hier
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(auth): replace identity template with explicit username in vault policies

Browse source 
Fixed document signing permissions by using explicit usernames in transit/sign
policies instead of relying on {{identity.entity.name}} templates, which were
not properly resolving during authorization checks. This enables users to
successfully sign documents with their respective vault transit keys.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Harald Hoyer 2025-03-20 17:06:09 +01:00
parent c132ba1722
commit c65ae95b43
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/vault_setup.rs
View file

@ -442,6 +442,9 @@ impl VaultClient {
Department::Finance => "finance", Department::Finance => "finance",
}; };
// Get the username from the policy name (remove "-policy" suffix)
let username = policy_name.trim_end_matches("-policy");
// Policy content with specific paths for the department // Policy content with specific paths for the department
let policy = format!(r#" let policy = format!(r#"
# Allow reading document metadata # Allow reading document metadata
@ -449,8 +452,8 @@ impl VaultClient {
capabilities = ["read"] capabilities = ["read"]
}} }}
# Allow signing with user's key # Allow signing with user's key - use explicit username instead of identity.entity.name
path "transit/sign/{{{{identity.entity.name}}}}" {{ path "transit/sign/{}" {{
capabilities = ["update"] capabilities = ["update"]
}} }}
@ -463,7 +466,7 @@ impl VaultClient {
path "documents/data/dept/{}/signatures/*" {{ path "documents/data/dept/{}/signatures/*" {{
capabilities = ["create", "read", "update"] capabilities = ["create", "read", "update"]
}} }}
"#, dept_name); "#, username, dept_name);
let url = format!("{}/v1/sys/policies/acl/{}", self.addr, policy_name); let url = format!("{}/v1/sys/policies/acl/{}", self.addr, policy_name);
let payload = json!({ let payload = json!({