Vault OIDC with google, how to restrict roles to specific groups

Question

I installed a vault and configured OIDC with gsuite, that was already an adventure in itself as the documentation is limited and even wrong at more than one place.

Finally I have a working authentication with my google accounts and I began to create roles, and there I saw a huge issue. How do you restrict google users from using a role. Let's say I create a gsuite-admin role that has access to all of vault administration, any user entering the role before login can assume it.

I tried to use the different claims but those seems to be only for vault created groups or other things.

Does anyone has a solution for that?

Thank you in advance.

EDIT:

The configuration I'm using whith group claims:

{
    “allowed_redirect_uris”: “https://URL/ui/vault/auth/oidc/oidc/callback,http://localhost:8250/oidc/callback”,
    “user_claim”: “sub”,
    “policies”: “vault_admin”,
    “ttl”: “24h”,
    “groups_claim”: “devops”,
    “oidc_scopes”: “profile”,
    “bound_claims”: {
        “group”: [“devops”]
    }
}

That configuration only provides a lock of the role that can't be used anymore by anyone. From what I could see the JWT doesn't have any informations and that is why we used the config with the fetchgroup option in the oidc configuration.

Answer 1

I found a solution for this problem. Firstly, we need to ensure that a user is part of a G Suite group. Then mapping the G Suite group with Vault group (that has a policy assigned) ensures that the user is bound to the Vault policy.

This article contains some example steps and might be helpful.