Backport of Replicate member_entity_ids and policies in identity/group across nodes identically into release/1.9.x

[hc-github-team-secure-vault-core]

Backport

This PR is auto-generated from #16088 to be assessed for backporting due to the inclusion of the label backport/1.9.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

merge conflict error: POST https://api.github.com/repos/hashicorp/vault/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

Addresses https://hashicorp.atlassian.net/browse/VAULT-2282
Example of reading an identity/group from a standby node:

{ "request_id": "4015c4c6-ee28-eec9-a42d-a0be91970dbc", "lease_id": "", "lease_duration": 0, "renewable": false, "data": { "alias": {}, "creation_time": "2022-06-21T05:56:12.378602Z", "id": "6a769520-f4b5-59a1-d7d7-21a650c91343", "last_update_time": "2022-06-21T05:56:12.378602Z", "member_entity_ids": null, "member_group_ids": [ "66bcfa57-8aab-04c8-d9ed-263bb5d2e6b0", "b7919faf-0a16-6acd-9e4d-82ac6db946bc" ], "metadata": null, "modify_index": 1, "name": "testgroup3", "namespace_id": "root", "parent_group_ids": null, "policies": [ "default" ], "type": "internal" }, "warnings": [ "Endpoint ignored these unrecognized parameters: [-format]" ] }

A group is marshalled and persisted in the leader node and then replicated to standby nodes. In standby node, memDB is populated after unmarshalling the group entry. However, member_entity_ids is an initialized empty slice when marshalled, but become a nil entry upon unmarshalling. This creates an inconsistency on the way active/standby nodes return the results.

To fix that, it was noticed that member_entity_ids field is nil, then passed into strutil.RemoveDuplicates function so that the duplicated entries be removed. That function returns an initialized empty slice regardless of the nil argument. The fix simply checks if the member_entity_ids field is not nil before passing it to that function. A test is going to be added to the ENT repo. Further details can be found in the ticket.

---

Overview of commits

• 2ccc3e0

[hashicorp-cla]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

temp seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}