Problem/Motivation

When something is wrong with how the Vault connection is configured, the admin/config/system/vault cannot be reached in order to try and fix said configuration. It gets blocked by an `Vault\Exceptions\RequestException: Bad status received from Vault in Vault\BaseClient->send()` exception.

Steps to reproduce

Poorly configure your vault in a way that causes Vault to return a status greater than 399. Like using bad authentication credentials.

Proposed resolution

Er, figure out where the exception can be caught and do so? I haven't dug into the code very far, so I haven't figured that out.

FYI, this is a Drupal 11 site. I'm using ddev, haven't deployed it yet.

I'm posting this because I think it's a bit odd for a bad connection to make it impossible to edit the configuration of said connection... I can work around the issue by uninstalling and reinstalling the module.

Comments

jerrac created an issue. See original summary.

jerrac’s picture

jerrac commented

So, just a quick note, the issue was that the config form didn't save my authentication plugin configuration. When I looked at vault.settings via the config single export screen, the `auth_plugin_config` value was `{}`.

I'm in dev mode, so I'm using tokens for authentication. So when I changed that value to ` token_key_id: my_token_id` it fixed the authentication issue, and the exception.

cmlara’s picture

cmlara
he/him
commented

I think it's a bit odd for a bad connection to make it impossible to edit the configuration of said connection

Agreed.

Do you have a full stack-trace? If so it could help speed up resolution.

cmlara’s picture

cmlara
he/him
commented
Status: Active » Postponed (maintainer needs more info)

I'm not currently able to replicate this, even when manually clearing the config to invalid status. The Status report for me indicates that the token is invalid.

I theorize something other than the config form (which makes no outbound calls) is trying to query to the Vault server. Do you have any custom code or any other Vault ecosystem modules enabled?

I do know that the TokenAuthStrategy always returns an Auth object which prevents us from detecting invalid authentication when obtaining the client from the factory, however send() is noted to thrown \Exception which should cover this, somewhere something is calling send() without error handling.

The full stacktrace would be extremely helpful to determine what the execution path is.

cmlara’s picture

cmlara
he/him
commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)

No additional feedback provided.

Closing as unable to reproduce.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.