Introduction
The OIDC method allows authentication via a configured OIDC provider using the user's web browser. When using the OIDC auth method, the
user_claim parameter is used to uniquely identify the user. This will be used as the name for the Identity entity alias created on a successful Vault login. If using Azure AD as your IdP and sAMAccountName for the user_claim, there are additional steps necessary on the Azure application.Azure AD Configuration
In order to allow Azure AD to pass
sAMAccountName in the access token, additional changes are necessary on the Azure application in use. For more specific changes, please check Microsoft's documentation. At a high level, optionalclaims will need to be added via the application manifest. Along with setting the necessary optionalclaims, acceptMappedClaims will also need to be set to true. Note that Microsoft adds "Do not set acceptMappedClaims property to true for multi-tenant apps, which can allow malicious actors to create claims-mapping policies for your app."Without setting
acceptMappedClaims to true, Vault will not be able to fetch the access token, with the following error: Error exchanging oidc code: Provider.Exchange: unable to exchange auth code with provider: oauth2: cannot fetch token: 400 Bad Request Additional Information:
Vault OIDC user_claim: https://developer.hashicorp.com/vault/api-docs/auth/jwt#user_claim
Microsoft acceptedMappedClaims: https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest#acceptmappedclaims-attribute