rancher/rancher · warning

extra key %q must not contain '/'

Error message

extra key %q must not contain '/'

What it means

Thrown by validateExtraKey (pkg/auth/requests/sar/sar.go:180) during the extras impersonation check: each Impersonation-Extra-* key becomes the subresource token 'userextras/<key>' in a SubjectAccessReview, so a '/' in the key would corrupt the resource path (parsing as subresource/subsubresource). Keys containing '/' are rejected before any API call; the denial surfaces through the extras check wrapper with 403.

Source

Thrown at pkg/auth/requests/sar/sar.go:180

}

func parseServiceAccountUsername(username string) (namespace string, name string, err error) {
	namespacedName := strings.TrimPrefix(username, serviceaccount.ServiceAccountUsernamePrefix)
	tokens := strings.Split(namespacedName, ":")
	if len(tokens) != 2 {
		return "", "", fmt.Errorf("invalid service account username format: expected system:serviceaccount:<namespace>:<name>, but got '%s'", username)
	}
	namespace = tokens[0]
	name = tokens[1]
	return namespace, name, nil
}

func validateExtraKey(name string) error {
	if name == "" {
		return errors.New("extra key must not be empty")
	}
	if strings.Contains(name, "/") {
		return fmt.Errorf("extra key %q must not contain '/'", name)
	}
	return nil
}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Use slash-free extra keys: letters, digits, '-', '_' (e.g. 'scopes' not 'auth/scopes')
2. Sanitize keys client-side before setting Impersonation-Extra-* headers
3. Grant RBAC on the sanitized userextras/<key> resource name that actually gets sent
4. Check Rancher logs: the wrapped 'error checking if user can impersonate extras' chains this exact message

Example fix

# before
Impersonation-Extra-auth/scopes: openid

# after
Impersonation-Extra-auth-scopes: openid

for key := range impExtras {
	if strings.ContainsAny(key, "/") || key == "" {
		return fmt.Errorf("extra key %q invalid: no '/' or empty", key)
	}
}

func validExtraKey(k string) bool { return k != "" && !strings.Contains(k, "/") }

When it happens

Trigger: Impersonation-Extra-scopes/email-address or any extra whose header-derived key contains '/', e.g. clients encoding namespaced or path-like identifiers into the extra name.

Common situations: Tools mapping arbitrary claim names (OIDC claim paths like 'ext/…' or URLs) into impersonation extras; proxies joining prefix+key with a slash; copied headers from upstream systems that use path-style keys.

Related errors

• error checking if user can impersonate extras: %w
• not allowed to impersonate extras
• multiple requesttokenid values
• invalid service account username format: expected system:ser
• error checking if user can impersonate service account: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/cad3ee19f250cdfa. Report an issue: GitHub.