Add OIDC login with role selection to vcm #4

2026-10-23T21:58:23+11:00

unkin-agent commented

2026-10-23 21:58:23 +11:00

vcm only supports password and token logins, so Vaults fronted by OIDC need the vault CLI. Per-context roles also let one Vault carry several contexts, one per OIDC role.

add method: oidc with the vault CLI browser flow, including form_post (loopback-only callback, default localhost:8250, 2m timeout)
add per-context role and oidc_listen, with --role / --listen login overrides
strip query strings from Vault request errors
add oidc to --method completion, docs and example config

vcm only supports password and token logins, so Vaults fronted by OIDC need the vault CLI. Per-context roles also let one Vault carry several contexts, one per OIDC role. - add `method: oidc` with the vault CLI browser flow, including form_post (loopback-only callback, default localhost:8250, 2m timeout) - add per-context `role` and `oidc_listen`, with `--role` / `--listen` login overrides - strip query strings from Vault request errors - add `oidc` to `--method` completion, docs and example config

unkin-agent commented

2026-10-23 22:00:16 +11:00

nit: shared/oidc.go:103 — a transport error from doRequest embeds the full callback URL (code, state, client_nonce) in the error, which goes to stderr and back to the browser page via line 67 → build a URL-free error for the callback exchange (e.g. strip the query or wrap with a fixed message).
nit: shared/oidc.go:35 — --listen :8250 / 0.0.0.0:8250 binds every interface and produces redirect_uri=http://:8250/... → reject a listen address whose host is empty or not loopback.
nit: shared/oidc.go:99 — only GET query params are read, so roles with oidc_response_mode=form_post fail with "missing code or state" (upstream cli.go handles the POST callback) → support the POST callback, or drop "the same flow as vault login -method=oidc" at docs/vcm.md:92 and document query mode only.

- nit: shared/oidc.go:103 — a transport error from doRequest embeds the full callback URL (`code`, `state`, `client_nonce`) in the error, which goes to stderr and back to the browser page via line 67 → build a URL-free error for the callback exchange (e.g. strip the query or wrap with a fixed message). - nit: shared/oidc.go:35 — `--listen :8250` / `0.0.0.0:8250` binds every interface and produces `redirect_uri=http://:8250/...` → reject a listen address whose host is empty or not loopback. - nit: shared/oidc.go:99 — only GET query params are read, so roles with `oidc_response_mode=form_post` fail with "missing code or state" (upstream cli.go handles the POST callback) → support the POST callback, or drop "the same flow as `vault login -method=oidc`" at docs/vcm.md:92 and document query mode only.

unkin-agent commented

2026-10-23 22:03:41 +11:00

No findings.

benvin changed target branch from benvin/vcm-rename to main

2026-10-23 22:32:50 +11:00

benvin added 2 commits 2026-10-23 22:32:50 +11:00

Add OIDC login with per-context role to vcm

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

588aea7858

Support OIDC form_post, require loopback listener, redact request URLs in errors

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ddc25139f7

benvin merged commit c895aec43c into main

2026-10-23 22:43:10 +11:00

benvin deleted branch benvin/vcm-oidc

2026-10-23 22:43:10 +11:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-tools#4