{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/2367","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/2367/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/2367/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/2367/events","html_url":"https://github.com/hashicorp/vault/issues/2367","id":207311993,"number":2367,"title":"Okta auth backends issue  not releasing token and policy.  ","user":{"login":"cere23","id":2778009,"avatar_url":"https://avatars.githubusercontent.com/u/2778009?v=3","gravatar_id":"","url":"https://api.github.com/users/cere23","html_url":"https://github.com/cere23","followers_url":"https://api.github.com/users/cere23/followers","following_url":"https://api.github.com/users/cere23/following{/other_user}","gists_url":"https://api.github.com/users/cere23/gists{/gist_id}","starred_url":"https://api.github.com/users/cere23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cere23/subscriptions","organizations_url":"https://api.github.com/users/cere23/orgs","repos_url":"https://api.github.com/users/cere23/repos","events_url":"https://api.github.com/users/cere23/events{/privacy}","received_events_url":"https://api.github.com/users/cere23/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-02-13T19:14:34Z","updated_at":"2017-02-13T19:14:34Z","closed_at":null,"body":"Summary: once the user is authenticated neither token nor policy is released .\r\n\r\n**My setup:** \r\n\r\nVault servers v0.6.5 in HA mode\r\nauth backend: okta \r\n\r\n**Step to reproduce:** \r\n\r\n1) Configure a user on Okta\r\n2) assign the  user to a group called test2 \r\n3) Enable Okta backend: \r\n$ vault auth-enable Okta\r\n\r\n4) Configure connection parameter: \r\n$vault write auth/okta/config base_url=\"okta.com\" \\\r\n  organization=\"bla-bla-aaa\" \\\r\n   token=\"xxxxxxxxxxxxxxxxxxxx\"\r\n   Success! Data written to: auth/okta/config\r\n\r\n5) Map policy Okta group: \r\nvault write auth/okta/groups/test2 policies=ssh \r\nSuccess! Data written to: auth/okta/groups/test2\r\n\r\nWhen I try to authenticate: \r\nvault auth -method=okta username= john@XXXXX.com\r\nPassword (will be hidden):\r\nPut https://$some_address:8200/v1/auth/okta/login/john@XXXXX.com: EOF\r\n\r\nOkta console let me know authentication was successful. \r\n\r\n\r\n**Relevant logs:** \r\n\r\n{\"time\":\"2017-02-13T16:27:04Z\",\"type\":\"request\",\"auth\":{\"client_token\":\"\",\"accessor\":\"\",\"display_name\":\"\",\"policies\":null,\"metadata\":null},\"request\":{\"id\":\"b083464e-dbd5-59af-ff44-5f4b743c0fef\",\"operation\":\"update\",\"client_token\":\"hmac-sha256:89f7d7524e36e751e4196065d603cffb8d490cbccb2839a309da42a9ec200440\",\"client_token_accessor\":\"\",\"path\":\"auth/okta/login//john@XXXXX.com\",\"data\":{\"password\":\"hmac-sha256:4df4d375991e63f98e7f295e7db15a874a4c2d2ce016c18a0392c5a6c3bdcd1d\"},\"remote_address\":\"10.9.1.180\",\"wrap_ttl\":0,\"headers\":{}},\"error\":\"\"}\r\n\r\nSo nor token or policy  is released. \r\n\r\n\r\n**Work-around:** \r\nI managed to make this work, after multiple attempts, adding fake data: \r\n\r\n$vault write auth/okta/users/john@XXXXX.com foo=bar\r\nSuccess! Data written to: auth/okta/users/john@XXXXX.com\r\n\r\n\r\n% vault auth -method=okta username=john@XXXXX.com\r\nPassword (will be hidden):\r\nSuccessfully authenticated! You are now logged in.\r\nThe token below is already saved in the session. You do not\r\nneed to \"vault auth\" again with the token.\r\ntoken:XXXXXXXXXXXXXXXXXXXXXXX\r\ntoken_duration: 2764800\r\ntoken_policies: [default full]"}}
{"actor":{"display_login":"cere23"}}