HashiCorp Vault — Authentication

1 minute read

Authentication is how clients prove their identity to Vault. Every successful authentication returns a Vault token with attached policies that determine what the client can access.

What’s in This Chapter?

# Topic Description
1 Token Auth Root tokens, service tokens, batch tokens, orphan tokens
2 Userpass & LDAP Username/password authentication for humans
3 AppRole Machine-to-machine authentication (role_id + secret_id)
4 OIDC & GitHub Browser-based SSO and GitHub org authentication
5 Kubernetes & AWS Auth Cloud-native identity-based authentication
6 Practice Exercises 5 hands-on exercises

How Authentication Works

┌──────────┐    ① Credentials     ┌─────────────┐
│  Client  │───────────────────▶ │  Auth Method │
│          │                      │  (Userpass,  │
│ (human   │                      │   AppRole,   │
│  or      │    ② Vault Token    │   OIDC, K8s) │
│  machine)│◀──────────────────── │              │
└──────────┘                      └──────┬───────┘
                                          │
                                   ③ Token includes:
                                   • Policies
                                   • TTL
                                   • Metadata
                                   • Entity ID

The authentication flow:

  1. Client presents credentials to an auth method
  2. The auth method validates credentials against an external source
  3. On success, Vault creates a token with attached policies
  4. Client uses the token for all subsequent requests

Auth Methods Overview

Auth Method Best For Credentials
Token All clients (built-in) Vault token
Userpass Human users (dev/test) Username + password
LDAP Enterprise human users LDAP credentials
AppRole Applications, CI/CD role_id + secret_id
OIDC Human users (SSO) Browser-based SSO flow
GitHub Developer teams GitHub personal token
Kubernetes K8s pods Service account JWT
AWS AWS workloads IAM role/instance profile
Azure Azure workloads Managed identity
GCP GCP workloads Service account / IAM
TLS Certificates Mutual TLS clients X.509 certificate

Enabling Auth Methods

# Enable userpass at default path
vault auth enable userpass

# Enable at a custom path
vault auth enable -path=corp-ldap ldap

# List enabled auth methods
vault auth list

Chapter Flow

Start with Token Auth — the foundational auth method that all others build upon.

Next: Token Auth

You may also enjoy