{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/6534","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/6534/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/6534/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/6534/events","html_url":"https://github.com/hashicorp/vault/issues/6534","id":429429114,"node_id":"MDU6SXNzdWU0Mjk0MjkxMTQ=","number":6534,"title":"Vault PKI doesn't seem to like common_names with commas","user":{"login":"seafoodbuffet","id":1646003,"node_id":"MDQ6VXNlcjE2NDYwMDM=","avatar_url":"https://avatars3.githubusercontent.com/u/1646003?v=4","gravatar_id":"","url":"https://api.github.com/users/seafoodbuffet","html_url":"https://github.com/seafoodbuffet","followers_url":"https://api.github.com/users/seafoodbuffet/followers","following_url":"https://api.github.com/users/seafoodbuffet/following{/other_user}","gists_url":"https://api.github.com/users/seafoodbuffet/gists{/gist_id}","starred_url":"https://api.github.com/users/seafoodbuffet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seafoodbuffet/subscriptions","organizations_url":"https://api.github.com/users/seafoodbuffet/orgs","repos_url":"https://api.github.com/users/seafoodbuffet/repos","events_url":"https://api.github.com/users/seafoodbuffet/events{/privacy}","received_events_url":"https://api.github.com/users/seafoodbuffet/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-04-04T18:47:40Z","updated_at":"2019-04-05T07:01:03Z","closed_at":"2019-04-05T07:01:03Z","author_association":"NONE","body":"<!-- Please reserve GitHub issues for bug reports and feature requests.\r\n\r\nFor questions, the best place to get answers is on our [mailing list](https://groups.google.com/forum/#!forum/vault-tool), as they will get more visibility from experienced users than the issue tracker.\r\n\r\nPlease note: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at security@hashicorp.com. Our PGP key is available at [our security page](https://www.hashicorp.com/security/).\r\n\r\n-->\r\n\r\n**Describe the bug**\r\nWe're using vault to generate client authentication certificates where clients are identified by a Distinguished Name-style common name (e.g. CN=foo,ou=bar,dc=com). Vault seems to reject such names even when allow_any_name is set to true. Is this intended? If so, is there a best-practice for CN's in client certs? Just use domain-names?\r\n\r\n**To Reproduce**\r\nSetup a Vault PKI role for client authentication:\r\n`vault write my-int-ca/roles/client allow_server=false allow_client=true allow_any_name=true allow_bare_domains=true max_ttl=1440h`\r\n\r\nIssue a barename cert works fine\r\n`vault write my-int-ca/issue/client common_name=foo`\r\n\r\nIssuing a cert with a comma in the name fails\r\n`vault write my-int-ca/issue/client common_name=foo,`\r\n\r\nThe error message is\r\n```\r\nError writing data to my-int-ca/issue/client: Error making API request.\r\n\r\nURL: PUT http://localhost:8200/v1/my-int-ca/issue/client\r\nCode: 400. Errors:\r\n\r\n* common name foo, not allowed by this role\r\n```\r\n\r\nThis also fails if you provide a valid DN (e.g. `CN=foo,dc=example,dc=com`)\r\n\r\n**Expected behavior**\r\nWe get a certificate with `TLS Web Client Authentication` extended usage with a CN value of `CN=foo,`\r\n\r\n**Environment:**\r\n* Vault Server Version (retrieve with `vault status`): 1.0.3\r\n* Vault CLI Version (retrieve with `vault version`): 1.0.3\r\n* Server Operating System/Architecture: Docker on Linux"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/480169946","html_url":"https://github.com/hashicorp/vault/issues/6534#issuecomment-480169946","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/6534","id":480169946,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4MDE2OTk0Ng==","user":{"login":"michelvocks","id":2463119,"node_id":"MDQ6VXNlcjI0NjMxMTk=","avatar_url":"https://avatars1.githubusercontent.com/u/2463119?v=4","gravatar_id":"","url":"https://api.github.com/users/michelvocks","html_url":"https://github.com/michelvocks","followers_url":"https://api.github.com/users/michelvocks/followers","following_url":"https://api.github.com/users/michelvocks/following{/other_user}","gists_url":"https://api.github.com/users/michelvocks/gists{/gist_id}","starred_url":"https://api.github.com/users/michelvocks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michelvocks/subscriptions","organizations_url":"https://api.github.com/users/michelvocks/orgs","repos_url":"https://api.github.com/users/michelvocks/repos","events_url":"https://api.github.com/users/michelvocks/events{/privacy}","received_events_url":"https://api.github.com/users/michelvocks/received_events","type":"User","site_admin":false},"created_at":"2019-04-05T07:01:03Z","updated_at":"2019-04-05T07:01:03Z","author_association":"MEMBER","body":"Hi there,\r\n\r\nVault validates automatically the CNs, DNS SANs, and the host part of email addresses by default.\r\nYou can turn off this behavior with the `enforce_hostnames` parameter: https://www.vaultproject.io/api/secret/pki/index.html#enforce_hostnames\r\n\r\n```\r\nvault write my-int-ca/roles/client allow_server=false enforce_hostnames=false allow_client=true allow_any_name=true allow_bare_domains=true max_ttl=1440h\r\n```\r\n\r\nClosing this now since it does not look like a bug. Please feel free to reopen this issue if you have any further questions.\r\n\r\nCheers,\r\nMichel"}}
{"actor":{"display_login":"michelvocks"}}