{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/781","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/781/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/781/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/781/events","html_url":"https://github.com/hashicorp/vault/issues/781","id":117244209,"number":781,"title":"new vault auth tokens don't work","user":{"login":"wwalker","id":23478,"avatar_url":"https://avatars.githubusercontent.com/u/23478?v=3","gravatar_id":"","url":"https://api.github.com/users/wwalker","html_url":"https://github.com/wwalker","followers_url":"https://api.github.com/users/wwalker/followers","following_url":"https://api.github.com/users/wwalker/following{/other_user}","gists_url":"https://api.github.com/users/wwalker/gists{/gist_id}","starred_url":"https://api.github.com/users/wwalker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwalker/subscriptions","organizations_url":"https://api.github.com/users/wwalker/orgs","repos_url":"https://api.github.com/users/wwalker/repos","events_url":"https://api.github.com/users/wwalker/events{/privacy}","received_events_url":"https://api.github.com/users/wwalker/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-16T23:31:45Z","updated_at":"2015-11-17T17:13:15Z","closed_at":"2015-11-17T17:13:15Z","body":"We create 2 policies (pg_devops_secret_{ro,rw} with these hcl files:\r\n\r\n::::::::::::::\r\nro.hcl\r\n::::::::::::::\r\n\r\n    path \"sys/*\" {\r\n      policy = \"deny\"\r\n    }\r\n\r\n    path \"secret/ops/configs/properties/product_groups/*\" {\r\n      policy = \"read\"\r\n    }\r\n\r\n    # Allow renewal of token leases\r\n    path \"auth/token/renew/\" {\r\n        policy = \"write\"\r\n    }\r\n\r\n::::::::::::::\r\nrw.hcl\r\n::::::::::::::\r\n\r\n    path \"sys/*\" {\r\n      policy = \"deny\"\r\n    }\r\n\r\n    path \"secret/ops/configs/properties/product_groups/*\" {\r\n      policy = \"write\"\r\n    }\r\n\r\n    # Allow renewal of token leases\r\n    path \"auth/token/renew/\" {\r\n        policy = \"write\"\r\n    }\r\n\r\nWe create the policies, then the users with these commands:\r\n\r\n    vault policy-write pg_devops_secret_ro ro.hcl\r\n    vault policy-write pg_devops_secret_rw rw.hcl\r\n\r\n    vault token-create -display-name=\"DevOps Product Group Write\" -lease=720h -policy pg_devops_secret_rw > pg_secret_rw.token\r\n    vault token-create -display-name=\"DevOps Product Group ReadOnly\" -lease=720h -policy pg_devops_secret_ro > pg_secret_ro.token\r\n\r\nOn my test server, this works fine.  On our QA and Staging servers, vault auth fails:\r\n\r\n    [wwalker@stg-mcontrol1 ~]$ curl --tlsv1.2 -X GET -H \"X-Vault-Token: $VAULT_TOKEN\" https://stg-mcontrol1:8200/v1/auth/token/lookup/REDACTED_TOKEN\r\n    {\"lease_id\":\"\",\"renewable\":false,\"lease_duration\":0,\"data\":{\"creation_time\":1447716540,\"display_name\":\"token-DevOps-Product-Group-ReadWrite\",\"id\":\"REDACTED_TOKEN\",\"meta\":null,\"num_uses\":0,\"path\":\"auth/token/create\",\"policies\":[\"pg_devops_secret_rw\"],\"ttl\":2592000},\"auth\":null}\r\n    [wwalker@stg-mcontrol1 ~]$ unset VAULT_TOKEN\r\n    [wwalker@stg-mcontrol1 ~]$ vault auth REDACTED_TOKEN\r\n    Error validating token: Error making API request.\r\n\r\n    URL: GET https://127.0.0.1:8200/v1/auth/token/lookup-self\r\n    Code: 403. Errors:\r\n\r\n    * permission denied\r\n    [wwalker@stg-mcontrol1 ~]$ \r\n"}}