[
https://issues.apache.org/jira/browse/NIFI-16327?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113357#comment-18113357
]
Pierre Villard commented on NIFI-16327:
---------------------------------------
Thanks for the detailed report. I traced the regression to the separate
VaultClient that Spring Vault 4.1 creates for non-token authentication. NiFi
currently applies *vault.namespace* to its main client, but not to this login
client.
Before preparing the fix, could you clarify:
# Which authentication methods have you reproduced this with? Is CERT the only
confirmed method, or have you also observed it with Kubernetes, AppRole, AWS,
or another method?
# Could you share a minimal redacted configuration that reproduces the issue,
including the authentication method, namespace format, and any custom
authentication path?
# Does the failure occur only during the initial login request, or have you
also observed namespace problems during token renewal or subsequent secret
operations?
# If available, could you share the relevant Vault response or audit-log entry
showing that the login request reached the root namespace?
# Are you already working on a patch or regression test for this issue?
> HC Vault namespace propagation error on non-token Authentication
> ----------------------------------------------------------------
>
> Key: NIFI-16327
> URL: https://issues.apache.org/jira/browse/NIFI-16327
> Project: Apache NiFi
> Issue Type: Bug
> Components: Extensions
> Affects Versions: 2.10.0, 2.11.0
> Reporter: Nicolas Chauvet
> Priority: Trivial
> Labels: vault
>
> The vault.namespace property was not propagated to login requests for CERT
> and other non-TOKEN authentication methods, because NIFI-16013 removed the
> restTemplateBuilder override that added the X-Vault-Namespace header. Spring
> Vault 4.1 builds the login VaultClient through that builder, so the login
> request was sent to the Vault root namespace.
> This is a regression introduced in 2.10.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
