fix: prevent duplicate member_entity_ids entries on OIDC login (#32057)

[waterWang]

Summary

Fixes #32057

Every OIDC login appends the authenticating entity's ID to the member_entity_ids list of each external identity group named in the user's groups claim — without checking whether the entity is already a member. The list grows by one entry per login per group, unbounded.

The LDAP auth path does not exhibit this issue. The identity/group API path also deduplicates. Only the OIDC login path in refreshExternalGroupMembershipsByEntityID skips this check.

Root Cause

In vault/identity_store_util.go, the refreshExternalGroupMembershipsByEntityID function at line 3144 does:

group.MemberEntityIDs = append(group.MemberEntityIDs, entityID)

This appends without checking if the entity ID is already present in the list. While the diffGroups function should prevent re-adding existing members, the fix adds an explicit defensive check to ensure deduplication regardless of the diff logic.

Fix

Wrap the append with a strutil.StrListContains guard:

if !strutil.StrListContains(group.MemberEntityIDs, entityID) {
    group.MemberEntityIDs = append(group.MemberEntityIDs, entityID)
}

The strutil package is already imported in this file.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jul 29, 2026 1:35pm

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

water seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}