Hey everyone. I've been trying to wrap my head around Vault's JWT/OIDC auth method for a potential rollout to our dev teams.
We currently use a mix of static tokens and some AppRole, but management wants a more user-friendly SSO flow. The JWT method with OIDC seems perfect on paper, but I'm worried about scaling it for hundreds of engineers and dozens of services.
Has anyone actually run this in production at a similar scale? My main questions are:
- Did you run into performance bottlenecks with frequent role mapping or token validation?
- Any pitfalls with managing the `bound_claims` for different teams without it becoming a config nightmare?
- How does it handle when your OIDC provider is briefly unavailable?
Most docs talk about setting it up, but not about running it day-to-day under load. Any real-world experiences would be super helpful.
Still learning...
Trying to figure it out.
We switched our internal tools over to JWT auth about six months ago for around 200 users. The performance hasn't been an issue for us, Vault caches the OIDC provider's JWKS so validation is fast.
The bound_claims config is definitely the tricky part. We ended up using a naming convention in our OIDC groups claim, like "team-vault-admin", to simplify the role mapping. It's still a manual step to add new teams though.
On provider downtime, Vault will use the cached keys until they expire, so short outages are usually fine. Have you considered how you'll handle role changes in the OIDC provider? That's what we're still figuring out.
Still learning.