{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/781","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/781/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/781/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/781/events","html_url":"https://github.com/hashicorp/vault/issues/781","id":117244209,"number":781,"title":"new vault auth tokens don't work","user":{"login":"wwalker","id":23478,"avatar_url":"https://avatars.githubusercontent.com/u/23478?v=3","gravatar_id":"","url":"https://api.github.com/users/wwalker","html_url":"https://github.com/wwalker","followers_url":"https://api.github.com/users/wwalker/followers","following_url":"https://api.github.com/users/wwalker/following{/other_user}","gists_url":"https://api.github.com/users/wwalker/gists{/gist_id}","starred_url":"https://api.github.com/users/wwalker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwalker/subscriptions","organizations_url":"https://api.github.com/users/wwalker/orgs","repos_url":"https://api.github.com/users/wwalker/repos","events_url":"https://api.github.com/users/wwalker/events{/privacy}","received_events_url":"https://api.github.com/users/wwalker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-16T23:31:45Z","updated_at":"2015-11-16T23:34:43Z","closed_at":null,"body":"We create 2 policies (pg_devops_secret_{ro,rw} with these hcl files:\r\n\r\n::::::::::::::\r\nro.hcl\r\n::::::::::::::\r\n\r\n    path \"sys/*\" {\r\n      policy = \"deny\"\r\n    }\r\n\r\n    path \"secret/ops/configs/properties/product_groups/*\" {\r\n      policy = \"read\"\r\n    }\r\n\r\n    # Allow renewal of token leases\r\n    path \"auth/token/renew/\" {\r\n        policy = \"write\"\r\n    }\r\n\r\n::::::::::::::\r\nrw.hcl\r\n::::::::::::::\r\n\r\n    path \"sys/*\" {\r\n      policy = \"deny\"\r\n    }\r\n\r\n    path \"secret/ops/configs/properties/product_groups/*\" {\r\n      policy = \"write\"\r\n    }\r\n\r\n    # Allow renewal of token leases\r\n    path \"auth/token/renew/\" {\r\n        policy = \"write\"\r\n    }\r\n\r\nWe create the policies, then the users with these commands:\r\n\r\n    vault policy-write pg_devops_secret_ro ro.hcl\r\n    vault policy-write pg_devops_secret_rw rw.hcl\r\n\r\n    vault token-create -display-name=\"DevOps Product Group Write\" -lease=720h -policy pg_devops_secret_rw > pg_secret_rw.token\r\n    vault token-create -display-name=\"DevOps Product Group ReadOnly\" -lease=720h -policy pg_devops_secret_ro > pg_secret_ro.token\r\n\r\nOn my test server, this works fine.  On our QA and Staging servers, vault auth fails:\r\n\r\n    [wwalker@stg-mcontrol1 ~]$ curl --tlsv1.2 -X GET -H \"X-Vault-Token: $VAULT_TOKEN\" https://stg-mcontrol1:8200/v1/auth/token/lookup/REDACTED_TOKEN\r\n    {\"lease_id\":\"\",\"renewable\":false,\"lease_duration\":0,\"data\":{\"creation_time\":1447716540,\"display_name\":\"token-DevOps-Product-Group-ReadWrite\",\"id\":\"REDACTED_TOKEN\",\"meta\":null,\"num_uses\":0,\"path\":\"auth/token/create\",\"policies\":[\"pg_devops_secret_rw\"],\"ttl\":2592000},\"auth\":null}\r\n    [wwalker@stg-mcontrol1 ~]$ unset VAULT_TOKEN\r\n    [wwalker@stg-mcontrol1 ~]$ vault auth REDACTED_TOKEN\r\n    Error validating token: Error making API request.\r\n\r\n    URL: GET https://127.0.0.1:8200/v1/auth/token/lookup-self\r\n    Code: 403. Errors:\r\n\r\n    * permission denied\r\n    [wwalker@stg-mcontrol1 ~]$ \r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/157209239","html_url":"https://github.com/hashicorp/vault/issues/781#issuecomment-157209239","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/781","id":157209239,"user":{"login":"wwalker","id":23478,"avatar_url":"https://avatars.githubusercontent.com/u/23478?v=3","gravatar_id":"","url":"https://api.github.com/users/wwalker","html_url":"https://github.com/wwalker","followers_url":"https://api.github.com/users/wwalker/followers","following_url":"https://api.github.com/users/wwalker/following{/other_user}","gists_url":"https://api.github.com/users/wwalker/gists{/gist_id}","starred_url":"https://api.github.com/users/wwalker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwalker/subscriptions","organizations_url":"https://api.github.com/users/wwalker/orgs","repos_url":"https://api.github.com/users/wwalker/repos","events_url":"https://api.github.com/users/wwalker/events{/privacy}","received_events_url":"https://api.github.com/users/wwalker/received_events","type":"User","site_admin":false},"created_at":"2015-11-16T23:34:43Z","updated_at":"2015-11-16T23:34:43Z","body":"Both the QA and STAGE clusters were working until recently.  We assumed that the token had expired (forgot to renew them), so we recreated the users in both vault clusters.  Now, neither of the clusters will let us auth at all with the new user (we've revoked and recreated both the policies and the auth tokens multiple times)."}}