{"action":"created","issue":{"url":"https://api.github.com/repos/hvac/hvac/issues/389","repository_url":"https://api.github.com/repos/hvac/hvac","labels_url":"https://api.github.com/repos/hvac/hvac/issues/389/labels{/name}","comments_url":"https://api.github.com/repos/hvac/hvac/issues/389/comments","events_url":"https://api.github.com/repos/hvac/hvac/issues/389/events","html_url":"https://github.com/hvac/hvac/issues/389","id":407060779,"node_id":"MDU6SXNzdWU0MDcwNjA3Nzk=","number":389,"title":"KV2 engine and restrictive policy leads to strange behaviour","user":{"login":"johnnybubonic","id":8520897,"node_id":"MDQ6VXNlcjg1MjA4OTc=","avatar_url":"https://avatars3.githubusercontent.com/u/8520897?v=4","gravatar_id":"","url":"https://api.github.com/users/johnnybubonic","html_url":"https://github.com/johnnybubonic","followers_url":"https://api.github.com/users/johnnybubonic/followers","following_url":"https://api.github.com/users/johnnybubonic/following{/other_user}","gists_url":"https://api.github.com/users/johnnybubonic/gists{/gist_id}","starred_url":"https://api.github.com/users/johnnybubonic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnnybubonic/subscriptions","organizations_url":"https://api.github.com/users/johnnybubonic/orgs","repos_url":"https://api.github.com/users/johnnybubonic/repos","events_url":"https://api.github.com/users/johnnybubonic/events{/privacy}","received_events_url":"https://api.github.com/users/johnnybubonic/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/hvac/hvac/milestones/11","html_url":"https://github.com/hvac/hvac/milestone/11","labels_url":"https://api.github.com/repos/hvac/hvac/milestones/11/labels","id":3932074,"node_id":"MDk6TWlsZXN0b25lMzkzMjA3NA==","number":11,"title":"0.7.3","description":"","creator":{"login":"jeffwecan","id":1158545,"node_id":"MDQ6VXNlcjExNTg1NDU=","avatar_url":"https://avatars2.githubusercontent.com/u/1158545?v=4","gravatar_id":"","url":"https://api.github.com/users/jeffwecan","html_url":"https://github.com/jeffwecan","followers_url":"https://api.github.com/users/jeffwecan/followers","following_url":"https://api.github.com/users/jeffwecan/following{/other_user}","gists_url":"https://api.github.com/users/jeffwecan/gists{/gist_id}","starred_url":"https://api.github.com/users/jeffwecan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeffwecan/subscriptions","organizations_url":"https://api.github.com/users/jeffwecan/orgs","repos_url":"https://api.github.com/users/jeffwecan/repos","events_url":"https://api.github.com/users/jeffwecan/events{/privacy}","received_events_url":"https://api.github.com/users/jeffwecan/received_events","type":"User","site_admin":false},"open_issues":16,"closed_issues":0,"state":"open","created_at":"2019-01-01T23:19:37Z","updated_at":"2019-02-08T15:03:37Z","due_on":"2019-02-01T08:00:00Z","closed_at":null},"comments":11,"created_at":"2019-02-06T02:47:30Z","updated_at":"2019-02-08T15:03:42Z","closed_at":null,"author_association":"NONE","body":"I have the following policy:\r\n\r\n```JSON\r\n\"paths\": {\r\n(...)\r\n        \"secret/data/foo/bar/*\": {\r\n            \"allowed_parameters\": {\r\n                \"x\": [],\r\n                \"y\": [],\r\n                \"z\": []\r\n            },\r\n            \"capabilities\": [\r\n                \"create\",\r\n                \"read\",\r\n                \"update\",\r\n                \"delete\",\r\n                \"list\"\r\n            ],\r\n(...)\r\n}\r\n```\r\n\r\nThe following works fine: `vault write secret/data/foo/bar/baz x=1 y=2 z=3`.\r\n\r\nHowever, using the same exact token in hvac:\r\n\r\n```Python\r\n>>> client.secrets.kv.v2.create_or_update_secret('foo/bar/baz', secret = {'x': '1', 'y': '2', 'z': '3'})\r\nTraceback (most recent call last):\r\n  File \"<stdin>\", line 1, in <module>\r\n  File \"/home/[REDACTED]/.local/lib/python3.7/site-packages/hvac/api/secrets_engines/kv_v2.py\", line 122, in create_or_update_secret\r\n    json=params,\r\n  File \"/home/[REDACTED]/.local/lib/python3.7/site-packages/hvac/adapters.py\", line 106, in post\r\n    return self.request('post', url, **kwargs)\r\n  File \"/home/[REDACTED]/.local/lib/python3.7/site-packages/hvac/adapters.py\", line 276, in request\r\n    utils.raise_for_error(response.status_code, text, errors=errors)\r\n  File \"/home/[REDACTED]/.local/lib/python3.7/site-packages/hvac/utils.py\", line 33, in raise_for_error\r\n    raise exceptions.Forbidden(message, errors=errors)\r\nhvac.exceptions.Forbidden: 1 error occurred:\r\n\t* permission denied\r\n```\r\n\r\nI did a tcpdump (since it was to an HTTP Vault server on localhost), and found that the Vault CLI client does e.g. (real values have been replaced):\r\n\r\n```\r\nPUT /v1/secret/data/foo/bar/baz HTTP/1.1\r\nHost: 127.0.0.1:8200\r\nUser-Agent: Go-http-client/1.1\r\nContent-Length: [REDACTED FOR DEMO]\r\nX-Vault-Token: [REDACTED FOR DEMO]\r\nAccept-Encoding: gzip\r\n\r\n{\"x\":\"1\",\"y\":\"2\",\"z\":\"3\"}\r\n```\r\n\r\nBUT the client.secrets.kv.v2.create_or_update_secret call does e.g. this (actual values replaced):\r\n\r\n```\r\nPOST /v1/secret/data/foo/bar/baz HTTP/1.1\r\nHost: localhost:8200\r\nUser-Agent: python-requests/2.21.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nConnection: keep-alive\r\nX-Vault-Token: [REDACTED FOR DEMO]\r\nContent-Length: [REDACTED FOR DEMO]\r\nContent-Type: application/json\r\n\r\n{\"options\": {}, \"data\": {\"x\": \"1\", \"y\": \"2\", \"z\": \"3\"}}\r\n```\r\n\r\nNotable differences are a POST vs. PUT, and the structure of the payload.\r\n\r\nFor whatever reason, this causes a permission denied error (403) for hvac, but the vault client succeeds.\r\n\r\nAt a *guess*, maybe [the docs](https://www.vaultproject.io/api/secret/kv/kv-v2.html#create-update-secret) are wrong? As the Vault client does not seem to conform to the docs (but hvac does).\r\n\r\nAre you able to replicate?"},"comment":{"url":"https://api.github.com/repos/hvac/hvac/issues/comments/461831350","html_url":"https://github.com/hvac/hvac/issues/389#issuecomment-461831350","issue_url":"https://api.github.com/repos/hvac/hvac/issues/389","id":461831350,"node_id":"MDEyOklzc3VlQ29tbWVudDQ2MTgzMTM1MA==","user":{"login":"johnnybubonic","id":8520897,"node_id":"MDQ6VXNlcjg1MjA4OTc=","avatar_url":"https://avatars3.githubusercontent.com/u/8520897?v=4","gravatar_id":"","url":"https://api.github.com/users/johnnybubonic","html_url":"https://github.com/johnnybubonic","followers_url":"https://api.github.com/users/johnnybubonic/followers","following_url":"https://api.github.com/users/johnnybubonic/following{/other_user}","gists_url":"https://api.github.com/users/johnnybubonic/gists{/gist_id}","starred_url":"https://api.github.com/users/johnnybubonic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnnybubonic/subscriptions","organizations_url":"https://api.github.com/users/johnnybubonic/orgs","repos_url":"https://api.github.com/users/johnnybubonic/repos","events_url":"https://api.github.com/users/johnnybubonic/events{/privacy}","received_events_url":"https://api.github.com/users/johnnybubonic/received_events","type":"User","site_admin":false},"created_at":"2019-02-08T15:03:42Z","updated_at":"2019-02-08T15:03:42Z","author_association":"NONE","body":"Thanks!"}}
{"actor":{"display_login":"johnnybubonic"}}