Skip to content

Conversation

@frco9
Copy link

@frco9 frco9 commented Oct 31, 2025

Description

closes #31613

I'm trying to write a templated policy to allow users to have access to a list of roles they can use.

Instead of writing a policy rule per database role, the templated policy I want looks like:

path "dummy-database-engine/static-roles/{{identity.entity.aliases.<<mount accessor>>.name}}-*" {
  capabilities = ["create", "update"]
}

In my case, the mount is an OIDC mount, and the entity alias name with the default plugin is the user_claim, which in my case is the user email

Without this PR, the @ character is invalid, so I cannot create a database role that will match this policy rule.
And I get the following error :

│ URL: PUT https://vault.customdomain.io/v1/dummy-database-engine/static-roles/[email protected]
│ Code: 404. Errors:
│ 
│ * 1 error occurred:
│ 	* unsupported path
│ 
│ 
│ 

@frco9 frco9 requested a review from a team as a code owner October 31, 2025 07:34
@vercel
Copy link

vercel bot commented Oct 31, 2025

@frco9 is attempting to deploy a commit to the HashiCorp Team on Vercel.

A member of the Team first needs to authorize it.

@hashicorp-cla-app
Copy link

hashicorp-cla-app bot commented Oct 31, 2025

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vault Database backend: Cannot have '@' symbol in path

2 participants