title: HashiCorp Vault OIDC SSO - Restricting Namespace Login Access to an Azure AD Group
body: <p>I have implemented an OIDC single sign-on solution for Vault, using Azure AD for user authentication. To date, it all works pretty well and myself and other users within my organisation are able to login to Vault successfully via Azure AD SSO.</p>
  <p>Not everything though is working as expected and having tried all manner of changes in an attempt to get things working, I have simply run out of options. Sadly, the documentation available from the HashiCorp website and my endless online research have failed to yield any positive results too.</p>
  <p>To date, I have an Azure AD app registered and configured successfully and I have also successfully provisioned and configured all of my core Vault resources using Terraform.</p>
  <p>Also in Azure AD, I have a created a couple of groups - one for our Vault Admins and the other for our Vault Users, as depicted in the below image. Both groups are mapped to two Vault external groups.</p>
  <p><a href="https://i.stack.imgur.com/IXmCx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IXmCx.png" alt="My Azure AD Groups" /></a></p>
  <p>In my Terraform code, I also have two OIDC auth method configurations, one mounted on the Root namespace and the other mounted on a child namespace. Below, I have provided a snippet of the terraform configuration for the Root namespace but not that of the child namespace, as frankly aside the odd name and/or reference change, they're almost identical and so the below example should be enough to provide adequate context.</p>
  <p>/* OIDC auth method mounted on ROOT namespace */</p>
  <pre><code>    resource &quot;vault_jwt_auth_backend&quot; &quot;root&quot; {
        description = &quot;OIDC single sign-on for the root namespace.&quot;
        oidc_discovery_url      = &quot;https://login.microsoftonline.com/${var.tenant_id}/v2.0&quot; 
        path                    = &quot;oidc&quot;
        type                    = &quot;oidc&quot;    
        oidc_client_id          = var.client_id
        oidc_client_secret      = var.client_secret
        default_role            = &quot;azure&quot;
  
        tune {
           max_lease_ttl      = &quot;90000s&quot;
           listing_visibility = &quot;unauth&quot;
           #listing_visibility = &quot;hidden&quot;    
          }
          provider_config = {
            provider = &quot;azure&quot;
            fetch_groups = true
            fetch_user_info = true
            groups_recurse_max_depth = 1
          }
  }  
    
      resource &quot;vault_jwt_auth_backend_role&quot; &quot;azure&quot; {
        role_name             = var.azure_role_name 
        backend               = vault_jwt_auth_backend.root.path
        user_claim            = &quot;email&quot;
        groups_claim          = &quot;groups&quot; 
        
        bound_claims          = { &quot;groups&quot;: &quot;VaultAdmins&quot; }
        
        role_type             = &quot;oidc&quot;
        oidc_scopes           = var.oidc_scopes 
        allowed_redirect_uris = var.allowed_redirect_uris
        verbose_oidc_logging  = &quot;true&quot; 
    }
  </code></pre>
  <p>So now onto the issue we're facing?</p>
  <p>If I was to comment out the <code>bound_claims</code> line in the <code>vault_jwt_auth_backend_role</code> configuration, all members of the two AD groups are able to log into Vault without any issues and completely unrestricted. This is however not how we intend to implement our solution.</p>
  <p>What we wish to set up is to restrict access to the Root namespace to only members of the VaultAdmins Azure AD group, all other users being blocked from gaining access. The remaining users who'll all be members of the VaultUsers Azure AD group, will be restricted to the child namespace through a similar Terraform configuration, albeit with the appropriate settings.</p>
  <p>With the current configuration, I keep getting the below error when attempting to login as a member of the VaultAdmins group. Other variations to the terraform configuration have likewise produced similar errors.</p>
  <p><a href="https://i.stack.imgur.com/0Dv0e.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0Dv0e.png" alt="enter image description here" /></a></p>
  <p>I'm inclined to believe that perhaps my <code>bound_claims</code> configuration is incorrect, but I simply cannot find any examples or help material to point me in the right direction. Any idea how I can get this working as desired?</p>
  <br>