mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-17 12:07:02 +02:00
ee55e36af6
Previously, the renew method would ALWAYS check to ensure the authenticated IAM principal ARN matched the bound ARN. However, there is a valid use case in which no bound_iam_principal_arn is specified and all bindings are done through inferencing. When a role is configured like this, clients won't be able to renew their token because of the check. This now checks to ensure that the bound_iam_principal_arn is not empty before requriing that it match the originally authenticated client. Fixes #2781 |
||
|---|---|---|
| .. | ||
| api | ||
| assets | ||
| docs | ||
| intro | ||
| layouts | ||
| _ember_steps.html.erb | ||
| _ember_templates.html.erb | ||
| .gitignore | ||
| 404.html.md | ||
| android-manifest.json.erb | ||
| community.html.erb | ||
| downloads.html.erb | ||
| favicon.ico | ||
| index.html.erb | ||
| microsoft-tile.xml.builder | ||
| robots.txt | ||
| security.html.erb | ||
| sitemap.xml.builder | ||