TLS auth problem "missing name in alias"

[Chris Coe]

Hello there,

I have been setting up a vault + consul cluster and have everything finally working right except that we want to use TLS certs to authenticate into vault from the CLI, libraries, etc.

I have followed this guide: https://www.vaultproject.io/docs/auth/cert.html

I generated my certs following this: https://www.consul.io/docs/guides/creating-certificates.html

Steps I took (generally):

1. create a certificate and private key (cert.pem, key.pem) (using cfssl in guide linked above)
2. enable TLS Certificates authentication (used default path of `cert`:
   
1. $ vault auth enable cert
   
   

2. vault write auth/cert/certs/cli \
       display_name=cli \
       policies=cli \
       certificate=@cli.pem \
       ttl=3600

   
   
3. create a new policy (I named the policy cli):
1. path "cert/*" {

   capabilities = ["create", "read", "update", "delete", "list"]

   }
2. this is fairly permissive on purpose until I get it working, then I will reduce.
   
   
4. attempt to log into policy with cert authentication - this is where the problems arise...

I have tried the following based on the guide:

$ curl -v --request POST --tlsv1.2 \
  --cacert ca.pem \
  --cert cli.pem \
  --key cli-key.pem \
  --data '{"name":"cli"}' \
  https://localhost:8200/v1/auth/cert/login

output I get:

{"errors":["missing name in alias"]}

Ok, that didn't work, so I tried:

$ vault login -method=cert -ca-cert=ca.pem -client-cert=cli.pem -client-key=cli-key.pem name=cli

output:

Error authenticating: Error making API request.

URL: PUT https://:8200/v1/auth/cert/login

Code: 500. Errors:

* missing name in alias

Same output...

So I searched the codebase and found this as the only place that error exists: 

https://github.com/hashicorp/vault/blob/786aff98aac107284872d7b778a0f7f6a73973fc/vault/request_handling.go#L788

Which appears to be part of the logic which looks for an alias name in the response, I am providing this (as detailed in the guide) as name=cli 

I am assuming that the alias would be whatever I name it when creating it and writing the policy to auth/cert/certs/cli

I looked into adding entities and aliases as detailed here: https://www.vaultproject.io/guides/identity/identity.html

I, of course needed to change it for TLS auth and not github as shown in the guide.  I am not using LDAP, username/pass, or github authentication currently and have no users in the system (outside of root).

[Chris Coe]

I should clarify that even after messing with entities, I was unsuccessful and was hoping someone could help provide some insight.

[Jeff Mitchell]

Hi Chris,

Currently the alias name comes from the Common Name of the cert. My guess is that there isn't one in your certificates. (If you can paste the PEM file that will help with debugging.)

Best,

Jeff

On Mon, Aug 13, 2018 at 2:39 PM Chris Coe <chrc...@gmail.com> wrote:

I should clarify that even after messing with entities, I was unsuccessful and was hoping someone could help provide some insight. 

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.

GitHub Issues: https://github.com/hashicorp/vault/issues
IRC: #vault-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Vault" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/92336035-1418-4acf-a361-b77baa450ce6%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Chris Coe]

As it turns out, the CA has a common name attribute set, but the others do not.  I did not set them because they are living on internal ephemeral servers and did not think it mattered as much.  I will regenerate them and post the outcome.

Thanks for the shove in the right direction.

[Chris Coe]

That was it, thank you Jeff - you spared me another hour tracing the vault codebase to figure out where the alias name was populated from!

[Jeff Mitchell]

No problem!

Arguably the common name isn't the best value to use for the alias name but it's not clear what else to use. It might become toggleable at some point.

Best,

Jeff

To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/742a324d-4435-4bf4-b615-55fb4e47bf21%40googlegroups.com.

[Tomoya Usami]

I'm facing the same problem as this case.
I guess CN is not a required field in X.509, so I think it's a problem that an error is occurred if it doesn't exist.

For instance, I'm using https://github.com/spiffe/spiffe, it doesn't provide CN field in X.509 certificates.

2018年8月14日火曜日 21時27分32秒 UTC+9 Jeff Mitchell:

[Louen Pilet]

Hello,

I'm triyng to using Vault with a certificate who doesn't have a common name field (the name is defined by an UID). Is it possible to bypass the "missing name in alias" error ?
Or do you have an other solution for use TLS certificate authentication with this certificate ?

Best,

Louen Pilet

To unsubscribe from this group and stop receiving emails from it, send an email to vault...@googlegroups.com.