Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BAO_ADDR is not propagated to the token helper when provided as -address #314

Open
ruuda opened this issue Apr 29, 2024 · 1 comment
Open
Labels
bug Something isn't working

Comments

@ruuda
Copy link
Contributor

ruuda commented Apr 29, 2024

Describe the bug

The token helper might inherit BAO_ADDR from the environment, but if the address is configured through the -address flag instead, then the token helper has no way of knowing about the address.

To Reproduce
Steps to reproduce the behavior:

  1. Set a program that prints BAO_ADDR and then fails as the token helper in ~/.bao.
  2. Run BAO_ADDR=foo bao login, observe it gets the BAO_ADDR.
  3. Run bao login -address foo, observe it does not get BAO_ADDR.

Expected behavior
The token helper needs to know the address of the instance it’s connecting to, so it can store a token per instance, that is the point of the token helper. Therefore, bao needs to set BAO_ADDR in the environment of the token helper it executes, and not rely on it being present implicitly.

Environment:

  • OpenBao Server Version (retrieve with bao status): irrelevant
  • OpenBao CLI Version (retrieve with bao version): OpenBao v2.0.0-alpha20240329 ('74c2dddb0612b9a3da79384c20638266aa7de407'), built 2024-04-26T10:19:19Z
  • Server Operating System/Architecture: Linux 6.8.7 / x86-64

OpenBao server configuration file(s): irrelevant

Additional context

This bug report is an adaptation of hashicorp/vault#22257.

@ruuda ruuda added the bug Something isn't working label Apr 29, 2024
@ruuda
Copy link
Contributor Author

ruuda commented Apr 29, 2024

I implemented a fix for this in hashicorp/vault#23218 that I want to port to OpenBao. The pull request was never included into Hashicorp Vault, so the Source-Available License Policy should not be a problem.

The changes touch parts of the code that would conflict with #313, so before I go ahead and adapt that change for OpenBao, I’m waiting to see what happens to #313.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant