VAULT-49081 Vault 2.1 release notes - #3111
Open
VioletHynes wants to merge 9 commits into
Open
Conversation
|
|
Contributor
Vercel Previews Deployed
|
VioletHynes
changed the title
Contributor
Broken Link CheckerThis PR contains broken links, but won't be blocked. Use this report to improve content quality: Quick Actions
Need Help?
Internal LinksExternal Links |
jasonpilz
self-requested a review
August 13, 2026 23:52
VioletHynes
marked this pull request as ready for review
August 14, 2026 19:41
schavis
requested changes
Aug 14, 2026
| validate against. Vault normalizes this value by trimming trailing slashes and | ||
| lowercasing. Each `issuer_id` must be unique across all profiles in the | ||
| namespace. | ||
| namespace. `issuer_id` cannot be modified during updates. |
Contributor
There was a problem hiding this comment.
Suggested change
| namespace. `issuer_id` cannot be modified during updates. | |
| namespace. You cannot modify `issuer_id` during updates. |
Style correction: write in active voice
Comment on lines
+264
to
+265
| `access_token` or `transaction_token`, though only `access_token` is currently | ||
| supported. |
Contributor
There was a problem hiding this comment.
Suggested change
| `access_token` or `transaction_token`, though only `access_token` is currently | |
| supported. | |
| `access_token`. |
There's no point introducing a second key value if we don't support it. We can add it back when we actually do support it
Collaborator
Author
There was a problem hiding this comment.
The API does support it --- i.e. you can set this value to transaction_token, but we don't actually support transaction tokens
Collaborator
Author
There was a problem hiding this comment.
Trying to find a balance of what our API supports versus what our product does
|
|
||
| 2. Create the entity alias for the subject entity with the mount accessor | ||
| and issuer values included. | ||
| 1. Create the entity alias for the subject entity the issuer value included. |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Create the entity alias for the subject entity the issuer value included. | |
| 1. Create the entity alias for the subject entity referenced by the issuer value. |
I think this is what we're trying to say? I'm a little confused by this sentence
|
|
||
| 3. Create the entity alias for the actor entity with the mount accessor | ||
| and issuer values included. | ||
| 3. Create the entity alias for the actor entity with the issuer value included. |
Contributor
There was a problem hiding this comment.
What does "with the issuer value included" mean? The new text suggests something about how you set things up has changed, but all we've done is remove a value from the setup. So I'm confused about what has changed in the functionality
Comment on lines
+212
to
+214
| For both aliases, the `mount_accessor` will be automatically generated. Since | ||
| there is no auth mount associated with these aliases, the alias instead points | ||
| to the issuer that grants access. The format is: |
Contributor
There was a problem hiding this comment.
Suggested change
| For both aliases, the `mount_accessor` will be automatically generated. Since | |
| there is no auth mount associated with these aliases, the alias instead points | |
| to the issuer that grants access. The format is: | |
| Vault automatically creates and assigns a `mount_accessor ` value for both aliases. | |
| The aliases are not associated with an auth mount. Instead, the aliases point to the | |
| issuer that grants access. Vault uses the following format for the mount accessor: |
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: Activation flag no longer required to use [OAuth Resource Server API](/vault/api-docs/system/config-oauth-resource-server)s. | ||
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: `issuer_id` is now immutable once a profile has been created, and can no longer be modified. |
Contributor
There was a problem hiding this comment.
Suggested change
| - **OAuth resource server** <EnterpriseAlert inline="true" />: `issuer_id` is now immutable once a profile has been created, and can no longer be modified. | |
| - **OAuth resource server**: `issuer_id` is now immutable once you create a profile and cannot be modified during profile updates. |
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: `issuer_id` is now immutable once a profile has been created, and can no longer be modified. | ||
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: Local profile support added [OAuth Resource Server](/vault/api-docs/system/config-oauth-resource-server) resources, wherein local profiles will not be replicated. |
Contributor
There was a problem hiding this comment.
Suggested change
| - **OAuth resource server** <EnterpriseAlert inline="true" />: Local profile support added [OAuth Resource Server](/vault/api-docs/system/config-oauth-resource-server) resources, wherein local profiles will not be replicated. | |
| - **OAuth resource server**: Local profile support added to [OAuth Resource Server](/vault/api-docs/system/config-oauth-resource-server) resources so that Vault does not replicate local profiles. |
How is this different from the entry under "Bug fixes"?
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: Local profile support added [OAuth Resource Server](/vault/api-docs/system/config-oauth-resource-server) resources, wherein local profiles will not be replicated. | ||
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [templated paths](/vault/docs/ai/oauth-server/rar/type-specification#templated-paths) in Rich Authorization Requests. |
Contributor
There was a problem hiding this comment.
Suggested change
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [templated paths](/vault/docs/ai/oauth-server/rar/type-specification#templated-paths) in Rich Authorization Requests. | |
| - **OAuth resource server**: Vault now supports [templated paths](/vault/docs/ai/oauth-server/rar/type-specification#templated-paths) in Rich Authorization Requests. |
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [templated paths](/vault/docs/ai/oauth-server/rar/type-specification#templated-paths) in Rich Authorization Requests. | ||
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [allowed, denied, and required parameters](/vault/docs/ai/oauth-server/rar/type-specification) in Rich Authorization Requests. |
Contributor
There was a problem hiding this comment.
Suggested change
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [allowed, denied, and required parameters](/vault/docs/ai/oauth-server/rar/type-specification) in Rich Authorization Requests. | |
| - **OAuth resource server**: Vault now supports [allowed, denied, and required parameters](/vault/docs/ai/oauth-server/rar/type-specification) in Rich Authorization Requests. |
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to use [allowed, denied, and required parameters](/vault/docs/ai/oauth-server/rar/type-specification) in Rich Authorization Requests. | ||
|
|
||
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to modify the uniqueness claim to be non-standard, for increased compatibility with IdPs that do not comply to the standard. |
Contributor
There was a problem hiding this comment.
Suggested change
| - **OAuth resource server** <EnterpriseAlert inline="true" />: The ability to modify the uniqueness claim to be non-standard, for increased compatibility with IdPs that do not comply to the standard. | |
| - **OAuth resource server**: To increase compatibility, you can now modify RAR uniqueness claims to be non-standard and use Vault with IdPs that do not comply to standard uniqueness requirements. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release notes for Vault 2.1.