identity: enforce key param and key existence on role creation

[fairclothjm]

This fixes a bug found after merging: #12151.

A role should not be allowed to be created without a key parameter. Additionally, the key must exist.

[pcman312]

Looks good overall. Just a couple of small readability improvement suggestions

[calvn]

Suggestion for adding two additional test cases, implementation looks good though!

[kalafut]

We should mark the param as required in the path definition:

vault/vault/identity_store_oidc.go

Lines 243 to 246 in a0e2449

	"key": {
	Type: framework.TypeString,
	Description: "The OIDC key to use for generating tokens. The specified key must already exist.",
	},

[calvn]

Since we're treating this as a breaking change, I milestoned it for 1.9

This fixes a bug found after merging: #12151.

We found the odd behavior from #12151 but IIRC this existed before it (i.e. allowing key to be empty/missing). We can ship #12151 in 1.8.1 and hold this off for 1.9.

[fairclothjm]

@calvn

Since we're treating this as a breaking change, I milestoned it for 1.9

This fixes a bug found after merging: #12151.

We found the odd behavior from #12151 but IIRC this existed before it (i.e. allowing key to be empty/missing). We can ship #12151 in 1.8.1 and hold this off for 1.9.

What I was trying to express there is that #12151 introduces a bug. An attempt to create a role with a key name that does not yet exist will fail with the error:

a role's token ttl cannot be longer than the verification_ttl of the key it references

This is what was discovered in the ENT tests that broke.

So if we are shipping #12151 in 1.8.1, I think there should be another fix to allow creating a role with a non-existent key.