bug: UI OIDC login fails with MFA enforcement ("role with oidc role_type is not allowed")

Author: qmugnierCreated Jun 12, 2026Updated Sep 17, 2026

Labelsbugui

Summary

When OIDC is configured as an auth method and Login MFA is enforced via an identity group (login enforcement scoped to identity_group_ids, not the role itself), logging in through the OpenBao UI fails with: {"errors":["role with oidc role_type is not allowed"]}

The CLI (bao login -method=oidc) works correctly and completes the full OIDC + TOTP MFA flow without issues.

Environment

OpenBao version: 2.5.4
Auth method: OIDC (Azure AD / Microsoft Entra)
MFA method: TOTP (Login MFA enforcement scoped to identity group)
Affected surface: Web UI only

Steps to Reproduce

Configure OIDC auth method with an secops role (Azure AD as IdP).
Create a TOTP MFA method.
Create a Login MFA enforcement targeting an identity group (not the OIDC role directly).
In the UI, log in via OIDC → complete IdP redirect → UI receives mfa_requirement block correctly.
UI attempts mfa/validate → returns role with oidc role_type is not allowed.

Evidence

OIDC callback response (correct — UI receives `mfa_requirement` as expected):

json

{
  "warnings": [
    "A login request was issued that is subject to MFA validation. Please make sure to validate the login by sending another request to mfa/validate endpoint."
  ],
  "auth": {
    "client_token": "",
    "mfa_requirement": {
      "mfa_request_id": "81f00663-bbcc-c41f-1680-ca1d89eb04bf",
      "mfa_constraints": {
        "vault-admins": {
          "any": [
            {
              "type": "totp",
              "id": "708ebe06-1bb1-f6cc-bcfe-670bea80b376",
              "uses_passcode": true
            }
          ]
        }
      }
    }
  }
}

Direct `curl` to `sys/mfa/validate` with the same `mfa_request_id` succeeds:

bash

curl -s -X POST https://<bao-host>/v1/sys/mfa/validate \
  -H "X-Vault-Token: " \
  -d '{
    "mfa_request_id": "<id>",
    "mfa_payload": {
      "708ebe06-1bb1-f6cc-bcfe-670bea80b376": ["<totp_code>"]
    }
  }'
# → Returns valid client_token with correct policies

This confirms the backend is fully functional. The bug is in the UI's post-OIDC-callback handling of the mfa_requirement response.

Root Cause (suspected)

The UI's OIDC callback route receives the mfa_requirement block but calls sys/mfa/validate with the OIDC role context still attached. The MFA validate handler contains a guard that rejects requests where the underlying role type is oidc, causing the error.

Upstream Reference — HashiCorp Vault fix

This is an identical bug that existed in HashiCorp Vault and was fixed in:

PR: https://github.com/hashicorp/vault/pull/28873 — "UI: Fix MFA + SSO login workflow"
Fixed in: Vault 1.18.3
Related issues:
- https://github.com/hashicorp/vault/issues/19702 — "OIDC Login with MFA TOTP reports 'role with oidc role_type is not allowed'"
- https://github.com/hashicorp/vault/issues/14671 — "Regression: OIDC Login 'role with oidc role_type is not allowed'"

The fix in Vault PR #28873 reworked the UI's oidc-callback route to properly decouple the mfa_request_id extraction and mfa/validate call from the OIDC role context. The equivalent change has not been ported to OpenBao's UI.

Suggested Fix

Port the UI changes from hashicorp/vault PR #28873 to OpenBao's UI layer:

File(s) likely involved: ui/app/routes/vault/cluster/oidc-callback.js (or equivalent in OpenBao's UI)
The fix should ensure that after the OIDC redirect completes and mfa_requirement is present in the callback response, the UI calls sys/mfa/validate with only the mfa_request_id and TOTP payload — without carrying the OIDC role type in the request context.

Workaround

Use the CLI for OIDC + MFA logins: