@@ -357,32 +357,28 @@ prevent duplicate password rotations on the LDAP server.
357357
358358| Change | Affected version | Fixed version |
359359| :--- | :--- | :--- |
360- | Known issue | 1.20.x, 1.19.x | None |
360+ | Known issue | 1.20.0+ | None |
361361
362- Write operations targeting a local auth mount on a performance replication secondary
363- cluster are incorrectly forwarded to the primary cluster for processing. This
364- prevents the independent configuration of local mounts on secondary clusters.
362+ Vault incorrectly forwards write operations targeting a local authentication
363+ mounts on a performance replication secondary to the primary cluster for
364+ processing. Forwarding the request prevents independent configuration of local
365+ mounts on secondary clusters for the following authentication methods:
365366
366- The following auth methods are affected:
367367- Azure
368368- GCP
369369- AWS
370- - LDAP
370+ - LDA
371371
372- This behavior leads to two distinct failure modes. If a local auth mount with the
373- same path exists on the primary, the write operation is incorrectly applied to
374- the primary's mount. If the auth mount path does not exist on the primary, the
375- secondary cluster panics with a ` nil pointer dereference ` error, causing the
376- Vault node to crash.
372+ Incorrect forwarding leads to two distinct failure modes:
377373
378- As a result, it is not possible to maintain independent configurations for
379- local mounts that share the same path across a primary and its secondaries.
380- Furthermore, attempting to use unique paths on the secondary that do not exist
381- on the primary leads to a panic as Vault will forward the request.
374+ 1 . If a local auth mount with the same path exists on the primary, Vault
375+ incorrectly applies the write operation to the primary node mount.
376+
377+ 1 . If the auth mount path does not exist on the primary, the secondary cluster
378+ panics with a ` nil pointer dereference ` error and the Vault node crashes.
382379
383380#### Recommendation
384381
385- There is currently no known workaround for this issue. Do not attempt to
386- configure local auth mounts on performance replication secondaries until a fix
387- is available.
382+ Do not attempt to configure local auth mounts on performance replication
383+ secondaries.
388384
0 commit comments