Skip to content

Latest commit

 

History

History
87 lines (59 loc) · 2.23 KB

README.md

File metadata and controls

87 lines (59 loc) · 2.23 KB
Raw

vault-ldap-auth

Example of configuring HashiCorp Vault to use LDAP for authentication

Final Environment

Getting Started

Deploy the CloudFormation infrastructure/cloudformation.json template. The template creates a user with the following credentials and minimal required permisisons to complete the Lab:

  • Username: student
  • Password: password

Instructions

  1. In the Cloud9 environment terminal, install Vault:

    wget https://releases.hashicorp.com/vault/0.10.3/vault_0.10.3_linux_amd64.zip -O /tmp/vault.zip
sudo unzip /tmp/vault.zip -d /usr/local/bin/

  2. Start the Vault server in development mode in a new terminal tab:

    vault server -dev

  3. In the original terminal tab, configure the Vault server address:

    export VAULT_ADDR='http://127.0.0.1:8200'

  4. Create a file named Engineering.hcl with the following Vault policy as its contents:

    path "secret/data/Engineering" {
    capabilities = ["create", "read", "update", "delete", "list"]
}

  5. Write the policy into Vault:

    vault policy write engineering Engineering.hcl

  6. Enable Vault LDAP auth:

    vault auth enable ldap

  7. Write the following LDAP auth config:

    vault write auth/ldap/config \
    url="ldap://ldap.ca-lab.private" \
    userattr="cn" \
    userdn="ou=Users,dc=ca-lab,dc=private" \
    groupdn="ou=Users,dc=ca-lab,dc=private" \
    groupfilter="(&(objectClass=groupOfNames)(member={{.UserDN}}))" \
    groupattr="cn"

  8. Map the engineering Vault policy to the engineering LDAP group:

    vault write auth/ldap/groups/Engineering policies=Engineering

  9. Login to Vault using LDAP with the following command, and enter sheep as the password when prompted:

    vault login -method=ldap username='Jeremy Cook'

  10. Confirm that you have the capabilities given in the engineering Vault policy:

    vault token capabilities secret/data/Engineering

Cleaning Up

Delete the CloudFormation stack to remove all the resources used in the Lab.