Ui not showing KV secret metadata tab

[JanMa]

Describe the bug
When using the UI to access KV secrets, it does not show the metadata of a given secret although the tokens policies grant access to it. Only if the policy grants metadata read access to all secrets, the tab is shown.

To Reproduce
Steps to reproduce the behavior:

1. Create a token with the following policy:

# List top-level key/value secrets metadata.
path "secret/metadata/" {
  capabilities = ["list"]
}

# List, create, update, and delete key/value secrets
path "secret/data/team_acme/*" {
  capabilities = ["create", "read", "update", "delete"]
}

path "secret/metadata/team_acme/*" {
  capabilities = ["read", "delete", "list"]
}

path "secret/delete/team_acme/*" {
  capabilities = ["update"]
}

path "secret/undelete/team_acme/*" {
  capabilities = ["update"]
}

path "secret/destroy/team_acme/*" {
  capabilities = ["update"]
}

2. Create some secret in the team_acme folder
3. Log in with the token and access secret in the UI
4. The metadata tab in the secret details is not shown.

Expected behavior
The UI should show the metadata tab because the policy allows accessing it.

Workaround
If the policy grants list and read access to all secrets, the metadata tab is shown in the secret details.

# List top-level key/value secrets metadata.
path "secret/metadata/*" {
  capabilities = ["list", "read"]
}

# List, create, update, and delete key/value secrets
path "secret/data/team_acme/*" {
  capabilities = ["create", "read", "update", "delete"]
}

path "secret/metadata/team_acme/*" {
  capabilities = ["read", "delete", "list"]
}

path "secret/delete/team_acme/*" {
  capabilities = ["update"]
}

path "secret/undelete/team_acme/*" {
  capabilities = ["update"]
}

path "secret/destroy/team_acme/*" {
  capabilities = ["update"]
}

Environment:

• Vault Server Version (retrieve with vault status): 1.10.2
• Vault CLI Version (retrieve with vault version): 1.10.2
• Server Operating System/Architecture: Vault HELM chart

[hellobontempo]

Thanks for reporting @JanMa! I've filed a ticket to track a fix. In the meantime, you should be able to navigate directly to http://localhost:8200/ui/vault/secrets/secret/metadata/team_acme/empty as a more secure workaround - so you don't have to make any policy changes.