-
Notifications
You must be signed in to change notification settings - Fork 7
Open
Description
Due to the way that the sts endpoint validation works, if a client is using the vpc endpoints for sts because there is no internet access (intentional), the alicloud auth backend will reject the sts endpoint with the error:
* error making upstream request: expected host of "sts.cn-hangzhou.aliyuncs.com" but received "sts-vpc.cn-hangzhou.aliyuncs.com"
This forces internet access on the Vault server.
The issue lies in this codeset, where the client.Network is not configurable in any way.
https://github.com/hashicorp/vault-plugin-auth-alicloud/blob/main/path_login.go#L258-L284
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels