Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

custom_metadata not updated on entity-alias when it's the only given parameter #19434

Closed
maxiscoding28 opened this issue Mar 2, 2023 · 0 comments · Fixed by #20368
Closed
Labels
bug Used to indicate a potential bug core/identity

Comments

@maxiscoding28
Copy link
Contributor

Describe the bug
A user is attempting to update only the custom_metadata field on an existing entity-alias.
https://developer.hashicorp.com/vault/api-docs/secret/identity/entity-alias#update-entity-alias-by-id

On version 1.9.2 the request throws a 500 error and the message "missing alias name".
On version 1.9.3 and above the request fails silently. The application indicates the updates was successful but the custom_metadata field isn't updated.

To Reproduce
Vault version 1.9.3 (and above, tested also on 1.12.2)

# Create a mount and save to a variable
vault auth enable -path=upass1 userpass
MA1=$(vault auth list -format=json | jq -r '."upass1/" | .accessor')

# Create an entity and save ID to variable
EID=$(vault write -field=id identity/entity name=max-winslow policies=entity-policy)

# Create an entity alias and save ID to variable
AID=$(vault write -field=id identity/entity-alias name=max1 canonical_id=$EID mount_accessor=$MA1)

# Read entity alias and verify that custom_metadata is empty
vault read identity/entity-alias/id/$AID

# Attempt to update only the custom_metadata field
vault write identity/entity-alias/id/$AID \
   - <<<'{"custom_metadata":{"foo":"bar"}}'
   
# Verify that the update failed silently by reading the entity-alias
vault read -field=custom_metadata identity/entity-alias/id/$AID

map[]

# Update entity alias with any other valid parameter for the endpoint 
# Dooesn't have to be name and doesn't have to be a new value for the additional parameter
vault write identity/entity-alias/id/$AID \
    mount_accessor=$MA1 \
    - <<<'{"custom_metadata":{"foo":"bar"}}'
 
# Verify that custom_metadata has now been updated
vault read -field=custom_metadata identity/entity-alias/id/$AID

map[foo:bar]

Vault version 1.9.2

# Create a mount and save to a variable
vault auth enable -path=upass1 userpass
MA1=$(vault auth list -format=json | jq -r '."upass1/" | .accessor')

# Create an entity and save ID to variable
EID=$(vault write -field=id identity/entity name=max-winslow policies=entity-policy)

# Create an entity alias and save ID to variable
AID=$(vault write -field=id identity/entity-alias name=max1 canonical_id=$EID mount_accessor=$MA1)

# Read entity alias and verify that custom_metadata is empty
vault read identity/entity-alias/id/$AID

# Attempt to update only the custom_metadata field (fails with 500)
vault write identity/entity-alias/id/$AID \
   - <<<'{"custom_metadata":{"foo":"bar"}}'
   
Error writing data to identity/entity-alias/id/5b6add1d-a796-4fda-7f13-fee0a6885b44: Error making API request.
URL: PUT http://127.0.0.1:8200/v1/identity/entity-alias/id/5b6add1d-a796-4fda-7f13-fee0a6885b44
Code: 500. Errors:
* 1 error occurred:
       * missing alias name

# Update entity alias with any other valid parameter for the endpoint 
# Dooesn't have to be name and doesn't have to be a new value for the additional parameter
vault write identity/entity-alias/id/$AID \
    mount_accessor=$MA1 \
    - <<<'{"custom_metadata":{"foo":"bar"}}'
 
# Verify that custom_metadata has now been updated
vault read -field=custom_metadata identity/entity-alias/id/$AID    

Expected behavior
Updating only the custom_metadata field should complete successfully. Also, documentation indicates name is a required parameter however this parameter is not required for updating other fields on entity-alias and is not even exclusively required in order to update custom_metadata any other valid parameter will allow the update to succeed.

Environment:
Tested on 1.9.2, 1.9.3 and 1.12.2

Additional context
It seems likely this behavior is related to an improvement introduced in 1.9.3 around the custom_metadata parameter for identity alias
#13395

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug core/identity
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants