From a83ddf244203328420036a055de74d65badd8fdf Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 31 Aug 2026 22:13:56 +1000 Subject: [PATCH] Grant the vault deployer sudo to enable the oidc auth mount Enabling and tuning an auth mount at sys/auth/ is sudo-protected, so the deployer identities got 403 on POST /v1/sys/auth/oidc despite already holding create/update/delete on sys/auth/*. --- policies/sys/auth/admin.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/policies/sys/auth/admin.yaml b/policies/sys/auth/admin.yaml index 026a0d7..9af620e 100644 --- a/policies/sys/auth/admin.yaml +++ b/policies/sys/auth/admin.yaml @@ -8,6 +8,24 @@ rules: - delete - read - list + # Enabling/tuning an auth mount is sudo-protected, and an exact path match + # wins over the wildcard above, so both rules repeat the full capability set. + - path: "sys/auth/oidc" + capabilities: + - create + - update + - delete + - read + - list + - sudo + - path: "sys/auth/oidc/tune" + capabilities: + - create + - update + - delete + - read + - list + - sudo auth: approle: