Hashicorp Vault is open source and can be used in DevOps processes for secure automated retrieval of keys and secrets.
\nI recently setup Vault as a password \/ key store. Here is how to configure Vault for Active Directory LDAP authentication.<\/p>\n
This setup assumes the following:
\n‘sAMAccountID’ is the username attribute within AD for the user\/s you want to authenticated to Vault.
\nThe user must be a member of a specific group to be granted access to the Vault secrets path.
\nVault is installed and initialized with the root token.<\/p>\n
1. Create a file named IT.hcl with the following Vault policy as its contents: Update 24\/09\/20: Hashicorp Vault is open source and can be used in DevOps processes for secure automated retrieval of keys and secrets. I recently setup Vault as…<\/p>\n","protected":false},"author":2,"featured_media":371,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[50,89,109,125,191],"class_list":["post-255","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-ad","tag-devops","tag-hashicorp","tag-ldap","tag-vault"],"acf":[],"yoast_head":"\n
\npath \"secret\/data\/IT\" {
\n capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}
\n<\/code>
\n2. Write the policy into the Vault:
\nvault policy write IT IT.hcl
\n<\/code>
\n3. Enable LDAP Auth:
\nvault auth enable ldap
\n4. Write the LDAP auth config (edit the values for your binddn, groups and server name):
\nvault write auth\/ldap\/config \\
\n url=\"ldap:\/\/server.domain.name\" \\
\n userattr=\"samaccountid\" \\
\n userdn=\"ou=Users,dc=domain,dc=name\" \\
\n groupdn=\"ou=Groups,dc=domain,dc=name\" \\
\n groupfilter=\"(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\" \\
\n groupattr=\"samaccountid\"
\n binddn=\"cn=vault,ou=users,dc=domain,dc=name\" \\
\n bindpass='My$ecrt3tP4ss' \\
\n upndomain=\"domain.name\"
\n<\/code>
\n5. Map the Vault IT policy to the IT AD group:
\nvault write auth\/ldap\/groups\/IT policies=IT
\n<\/code>
\nNote that in AD the group should be named ‘IT’ (for this example)
\n6. Test Vault AD Authentication:
\nvault login -method=ldap username='myUser'
\n<\/code>
\n7. Confirm your AD user has the permissions set in the IT Vault policy:
\nvault token capabilities secret\/data\/IT
\n<\/code>
\nIn this example the AD user myUser is a member of the AD group ‘IT’ which has full permission to the \/secret\/data\/IT Vault.
\nAll done \ud83d\ude42<\/p>\n
\nTo disable certificate based authentication edit the vault config.json file option as follows:
\ndisable_cache = true
\ndisable_mlock = true
\nui = true
\nlistener \"tcp\" {
\n address = \"0.0.0.0:8200\"
\n tls_disable = 0
\n tls_cert_file = \"\/path\/to\/cert.crt\"
\n tls_key_file = \"\/path\/to\/rsa.key\"
\n tls_disable_client_certs = true
\n}
\napi_addr = \"https:\/\/servername.com:8200\"
\nstorage \"file\" {
\n path = \"\/vault-data\"
\n}
\nmax_lease_ttl = \"10h\"
\ndefault_lease_ttl = \"10h\"<\/code>
\nThe above config.json is generated when you run the the vault binary for the first time. The option to disable client cert authentication is tls_disable_client_certs set to true. You can also use the above config.json as an example on how to enable TLS\/SSL on the vault app.<\/p>\n","protected":false},"excerpt":{"rendered":"