Skip to content

Commit e44237d

Browse files
yhyakunayhyakuna
authored
Add the updated LDAP secrets engine docs to v1.20.x and v1.19.x (#1418)
1 parent 4c65bfa commit e44237d

File tree

158 files changed

+5982
-1322
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

158 files changed

+5982
-1322
lines changed

‎content/vault/v1.19.x/content/docs/secrets/ldap.mdx‎

Lines changed: 0 additions & 660 deletions
This file was deleted.

‎content/vault/v1.19.x/content/docs/secrets/ldap/account-library.mdx‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
layout: docs
3+
page_title: Create a service account library
4+
description: >-
5+
Create a library of LDAP service accounts that users and machines can check-out
6+
as needed.
7+
---
8+
9+
# Create a service account library
10+
11+
Create a library of service accounts that users and machines can check out as
12+
needed. Vault automatically rotates the account password when clients return the
13+
service account to the library.
14+
15+
16+
## Before you start
17+
18+
- **Check your Vault permissions**. You must have permission to enable and
19+
configure plugins in Vault.
20+
- **You must have an LDAP plugin configured for OpenLDAP or Active Directory**.
21+
If you do not already have an LDAP plugin enabled, follow the
22+
[setup guide](/vault/docs/secrets/ldap/setup).
23+
- **Create the library accounts on your LDAP server**. We highly recommend
24+
creating a dedicated accounts for the library.
25+
26+
27+
## Step 1: Create a library configuration file
28+
29+
For easier maintenance and reuse, create a JSON file `library.json`, with the
30+
credential library configuration details.
31+
32+
```json
33+
{
34+
"service_account_names": "<list_of_LDAP_accounts>",
35+
"ttl": "<default_checkout_period>",
36+
"max_ttl": "<max_allowed_checkout_period>",
37+
"disable_check_in_enforcement": "false"
38+
}
39+
```
40+
41+
For example:
42+
43+
```json
44+
{
45+
"service_account_names": "[email protected],[email protected]",
46+
"ttl": "10h",
47+
"max_ttl": "24h",
48+
"disable_check_in_enforcement": "false"
49+
}
50+
```
51+
52+
the following configuration file:
53+
54+
- defines the set of accounts in the library as `[email protected]` and `[email protected]`
55+
- sets a default checkout time of 10 hours
56+
- disallows renewals after 24 hours
57+
- requires that the same Vault entity or client token checking out a service
58+
account also be the one to check the account back into the library.
59+
60+
<Tip>
61+
62+
If your workflow uses a clean up process such that the client returning the
63+
service account regularly uses a different token than the client checking the
64+
account out, set `disable_check_in_enforcement=true`.
65+
66+
</Tip>
67+
68+
69+
70+
## Step 2: Configure the plugin
71+
72+
Apply the libray configuration file to your plugin.
73+
74+
<Tabs>
75+
76+
<Tab heading="CLI" group="cli">
77+
78+
@include 'ldap/create-library/cli.mdx'
79+
80+
</Tab>
81+
82+
<Tab heading="API" group="api">
83+
84+
@include 'ldap/create-library/api.mdx'
85+
86+
</Tab>
87+
88+
</Tabs>
89+
90+
91+
92+
## Step 3: Verify the service account settings
93+
94+
To verify the library settings, view the set status.
95+
96+
<Tabs>
97+
98+
<Tab heading="CLI" group="cli">
99+
100+
@include 'ldap/view-library/cli.mdx'
101+
102+
</Tab>
103+
104+
<Tab heading="API" group="api">
105+
106+
@include 'ldap/view-library/api.mdx'
107+
108+
</Tab>
109+
110+
</Tabs>
111+
112+
113+
114+
## Step 3: Test the check-out process
115+
116+
To test the connection between Vault and your LDAP server, try checking out
117+
and returning a service account.
118+
119+
120+
<Tabs>
121+
122+
<Tab heading="CLI" group="cli">
123+
124+
@include 'ldap/account-checkout/cli.mdx'
125+
126+
@include 'ldap/account-checkin/cli.mdx'
127+
128+
</Tab>
129+
130+
<Tab heading="API" group="api">
131+
132+
@include 'ldap/account-checkout/api.mdx'
133+
134+
@include 'ldap/account-checkin/api.mdx'
135+
136+
</Tab>
137+
138+
</Tabs>

‎content/vault/v1.19.x/content/docs/secrets/ldap/cookbook/account-library/checkin.mdx‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
layout: docs
3+
page_title: Check in a service account
4+
description: >-
5+
Return a service account previously checked out from an LDAP library
6+
---
7+
8+
# Check in a service account
9+
10+
Return a service account previously checked out from a previously configured
11+
LDAP library.
12+
13+
<Tip title="Assumptions">
14+
15+
- You have [set up an `ldap` plugin](/vault/docs/secrets/ldap/setup).
16+
- You have [created an LDAP account library](/vault/docs/secrets/ldap/account-library).
17+
18+
</Tip>
19+
20+
21+
Returing a service account to the library tells Vault to rotate the associated
22+
password.
23+
24+
<Tabs>
25+
26+
<Tab heading="CLI" group="cli">
27+
28+
@include 'ldap/account-checkin/cli.mdx'
29+
30+
</Tab>
31+
32+
<Tab heading="API" group="api">
33+
34+
@include 'ldap/account-checkin/api.mdx'
35+
36+
</Tab>
37+
38+
</Tabs>

‎content/vault/v1.19.x/content/docs/secrets/ldap/cookbook/account-library/checkout.mdx‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: docs
3+
page_title: Check out a service account
4+
description: >-
5+
Check out a service account from an LDAP library
6+
---
7+
8+
# Check out a service account
9+
10+
The LDAP secrets plugin lets clients check out service accounts from a
11+
previously configured LDAP library.
12+
13+
<Tip title="Assumptions">
14+
15+
- You have [set up an `ldap` plugin](/vault/docs/secrets/ldap/setup).
16+
- You have [created an LDAP account library](/vault/docs/secrets/ldap/account-library).
17+
18+
</Tip>
19+
20+
21+
<Tabs>
22+
23+
<Tab heading="CLI" group="cli">
24+
25+
@include 'ldap/account-checkout/cli.mdx'
26+
27+
@include 'ldap/account-checkin/cli.mdx'
28+
29+
</Tab>
30+
31+
<Tab heading="API" group="api">
32+
33+
@include 'ldap/account-checkout/api.mdx'
34+
35+
@include 'ldap/account-checkin/api.mdx'
36+
37+
</Tab>
38+
39+
</Tabs>

‎content/vault/v1.19.x/content/docs/secrets/ldap/cookbook/account-library/extend-lease.mdx‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: docs
3+
page_title: Extend a service account lease
4+
description: >-
5+
Extend a service account lease to avoid rotating the associated password.
6+
---
7+
8+
# Extend a service account lease
9+
10+
The LDAP secrets plugin lets clients extend the lease for checked out service
11+
accounts as long as the renewal does not violate the maximum TTL of the service
12+
account.
13+
14+
<Tip title="Assumptions">
15+
16+
- You have [set up an `ldap` plugin](/vault/docs/secrets/ldap/setup).
17+
- You have [created an LDAP account library](/vault/docs/secrets/ldap/account-library).
18+
- You know the full lease ID for the service account from the original account
19+
checkout.
20+
21+
</Tip>
22+
23+
To extend a check-out so the current password lives longer, renew its lease.
24+
25+
<Tabs>
26+
27+
<Tab heading="CLI" group="cli">
28+
29+
@include 'ldap/extend-lease/cli.mdx'
30+
31+
</Tab>
32+
33+
<Tab heading="API" group="api">
34+
35+
@include 'ldap/extend-lease/api.mdx'
36+
37+
</Tab>
38+
39+
</Tabs>

‎content/vault/v1.19.x/content/docs/secrets/ldap/cookbook/account-library/revoke-lease.mdx‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
layout: docs
3+
page_title: Revoke a service account lease
4+
description: >-
5+
Force the return of a service account and rotate the associated password.
6+
---
7+
8+
# Revoke a service account lease
9+
10+
The LDAP secrets plugin lets operators revoke the lease for checked out service
11+
account to force a password rotation.
12+
13+
<Tip title="Assumptions">
14+
15+
- You have [set up an `ldap` plugin](/vault/docs/secrets/ldap/setup).
16+
- You have [created an LDAP account library](/vault/docs/secrets/ldap/account-library).
17+
- You know the full lease ID for the service account from the original account
18+
checkout.
19+
20+
</Tip>
21+
22+
23+
<Tabs>
24+
25+
<Tab heading="CLI" group="cli">
26+
27+
@include 'ldap/revoke-lease/cli.mdx'
28+
29+
</Tab>
30+
31+
<Tab heading="API" group="api">
32+
33+
@include 'ldap/revoke-lease/api.mdx'
34+
35+
</Tab>
36+
37+
</Tabs>

‎content/vault/v1.19.x/content/docs/secrets/ldap/cookbook/hash-passwords.mdx‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
layout: docs
3+
page_title: Hash LDAP passwords
4+
description: >-
5+
Hash LDAP passwords
6+
---
7+
8+
# Hash LDAP passwords
9+
10+
The LDAP secret engine does not hash or encrypt passwords before modifying
11+
values in LDAP, which can lead to plaintext passwords on your LDAP server.
12+
13+
<Tip title="Assumptions">
14+
15+
- You have permission to update your LDAP server.
16+
- You know the data information tree (DIT) assocaited with your `ldap` plugin.
17+
18+
</Tip>
19+
20+
We recommend configuring your LDAP server with an LDAP password policy that
21+
hashes passwords by default on the DIT used by your plugin:
22+
23+
<CodeBlockConfig highlight="11">
24+
25+
```
26+
dn: cn=module{0},cn=config
27+
changetype: modify
28+
add: olcModuleLoad
29+
olcModuleLoad: ppolicy
30+
31+
dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
32+
changetype: add
33+
objectClass: olcPPolicyConfig
34+
objectClass: olcOverlayConfig
35+
olcOverlay: {2}ppolicy
36+
olcPPolicyDefault: cn=default,ou=pwpolicies,<ldap_plugin_dit>
37+
olcPPolicyForwardUpdates: FALSE
38+
olcPPolicyHashCleartext: TRUE
39+
olcPPolicyUseLockout: TRUE
40+
```
41+
42+
</CodeBlockConfig>
43+
44+
For example, to hash data on the `dc=hashicorp,dc=com` DIT:
45+
46+
<CodeBlockConfig highlight="11">
47+
48+
```
49+
dn: cn=module{0},cn=config
50+
changetype: modify
51+
add: olcModuleLoad
52+
olcModuleLoad: ppolicy
53+
54+
dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
55+
changetype: add
56+
objectClass: olcPPolicyConfig
57+
objectClass: olcOverlayConfig
58+
olcOverlay: {2}ppolicy
59+
olcPPolicyDefault: cn=default,ou=pwpolicies,dc=hashicorp,dc=com
60+
olcPPolicyForwardUpdates: FALSE
61+
olcPPolicyHashCleartext: TRUE
62+
olcPPolicyUseLockout: TRUE
63+
```
64+
65+
</CodeBlockConfig>

0 commit comments

Comments
 (0)