HashiCorp Vault Authentication Methods

HashiCorp Vault Authentication Methods - Complete Implementation Guide

🎯 Prerequisites: HashiCorp Vault Fundamentals
📚 What You'll Master:
Complete authentication implementation from internal methods (userpass, AppRole) to external integrations (LDAP, AWS, GitHub) with hands-on configuration

Table of Contents

1. Authentication Methods Overview
2. Choosing the Right Method
3. Internal Methods: Userpass & AppRole
4. Configuration & Management
5. Hands-On Implementation
6. External Authentication Sources

Authentication Methods Overview

Before you can access any secrets stored in Vault, you must authenticate to it. Understanding Vault's authentication methods is crucial for implementing secure access controls in your infrastructure.

How Authentication Methods Work

The various authentication methods in Vault are provided by a set of plugins bundled with the binary. Key characteristics include:

• Multiple Methods Supported - Enable multiple authentication methods simultaneously
• Multiple Instances - Run multiple instances of the same method (e.g., separate Active Directory forests)
• External Integration - Reference external sources like LDAP, Active Directory, GitHub, AWS IAM
• Token-Based Result - All methods ultimately return a token for subsequent operations

Authentication Method Categories

External Sources:

• Cloud Providers - AWS, Azure, GCP authentication plugins
• Cloud Native - Kubernetes, Cloud Foundry, GitHub, JSON Web Tokens
• Traditional Enterprise - LDAP, RADIUS, Kerberos

Internal Sources (Vault Native):

• Token - Default method, cannot be disabled
• Userpass - Username/password authentication
• AppRole - Machine/application authentication

Critical Concept: The Token Method

🔑 Key Understanding:
The token method is the main authentication method. Every other authentication method returns a token, which you then use against the token method. The token method is:

• Enabled by default
• Cannot be disabled
• Mounted on /auth path
• The final authentication mechanism for all methods

Choosing the Right Authentication Method

Selecting the appropriate authentication method requires answering key questions about your use case:

Decision Framework

1. Who is accessing Vault?

• External users vs internal users
• Humans vs machines/applications
• Interactive vs programmatic access

2. How will they access it?

• Manual keyboard input
• Unified experience across systems
• Automated machine credentials

3. What do they use today?

• Existing GitHub accounts
• Active Directory infrastructure
• Certificate-based authentication
• Cloud provider identities

Real-World Scenarios

Scenario 1: Developer Access

Requirements:

• Developers need AWS secrets access
• All internal users have Active Directory accounts
• All developers have GitHub accounts
• Contract developers lack AD accounts

Solution: Enable GitHub authentication method with personal access tokens - accommodates all developer types.

Scenario 2: Server Access

Requirements:

• On-premises Linux servers need secrets
• Servers not in Active Directory domain
• Must be programmatic (no user prompts)
• All servers on same IP subnet

Solution: Enable AppRole authentication with CIDR constraints for IP-based security.

Internal Methods: Userpass & AppRole

Userpass Authentication

Designed for human operators requiring interactive authentication:

• Components - Username and password combination
• Storage - Information stored internally in Vault
• Convenience - No external dependencies required
• Maintenance - Requires separate management from other identity systems
• Use Case - Individual user access to Vault resources

AppRole Authentication

Designed for machines and applications requiring programmatic access:

• Components - RoleID (like username) and SecretID (like password)
• Nature - Non-interactive, programmatic authentication
• Security - SecretID requires careful distribution management
• Distribution Options:
  • Push Model - Vault pushes SecretID to client
  • Pull Model - Client pulls SecretID on boot with pre-configured information

Configuration & Management

Authentication Method Lifecycle

Path Structure:

• All auth methods use /auth path (actually /sys/auth)
• Default path equals method name (e.g., auth/userpass)
• Important: Methods cannot be moved after enabling - only disabled and re-enabled

Tuning vs Configuration:

• Tuning Settings - Common to all authentication methods
• Configuration Settings - Specific to particular method implementation

Essential Management Commands

List Authentication Methods:

vault auth list

Enable Authentication Method:

# Default path
vault auth enable userpass

# Custom path
vault auth enable -path=globopass userpass

Tune Authentication Method:

vault auth tune -description="Company Userpass" userpass

Disable Authentication Method:

vault auth disable userpass

⚠️ Critical Warning:
Disabling an authentication method deletes all stored information including configuration. This action cannot be undone!

Hands-On Implementation

Step 1: Enable Authentication Methods

Enable Userpass via CLI:

# Start Vault development server
vault server -dev

# Set environment and login
export VAULT_ADDR="http://127.0.0.1:8200"
vault login [root-token]

# Enable userpass
vault auth enable userpass

Enable AppRole via UI:

1. Access Vault UI at http://127.0.0.1:8200/ui
2. Navigate to Access tab
3. Click Enable new method
4. Select AppRole from list
5. Configure custom path: GloboAppRole
6. Set Default Lease TTL: 60 minutes
7. Click Enable Method

Step 2: Configure Authentication Methods

Configure Userpass Users:

# Get help on userpass configuration
vault path-help auth/userpass
vault path-help auth/userpass/users
vault path-help auth/userpass/users/something

# Create user via CLI
vault write auth/userpass/users/ned password=tacos

# User can also be created via UI in Access → userpass → Create user

Configure AppRole:

# Get help on AppRole configuration
vault path-help auth/GloboAppRole
vault path-help auth/GloboAppRole/role/something

# Create AppRole
vault write auth/GloboAppRole/role/webapp \
role_name=webapp \
secret_id_num_uses=1 \
secret_id_ttl=2h

Step 3: Authentication Usage

Interactive vs Programmatic Methods:

• vault login - For interactive methods (userpass, GitHub tokens)
• vault write - For programmatic methods (AppRole, API calls)

Userpass Authentication:

# Interactive login
vault login -method=userpass username=ned
# Prompts for password

# Programmatic login
vault write auth/userpass/login/ned password=tacos

AppRole Authentication:

# Get RoleID
vault read auth/GloboAppRole/role/webapp/role-id
ROLE_ID="[role-id-value]"

# Generate SecretID
vault write -force auth/GloboAppRole/role/webapp/secret-id
SECRET_ID="[secret-id-value]"

# Authenticate with AppRole
vault write auth/GloboAppRole/login \
role_id=$ROLE_ID \
secret_id=$SECRET_ID

Step 4: API Authentication

AppRole via API:

# Generate new SecretID (previous one used up)
vault write -force auth/GloboAppRole/role/webapp/secret-id

# Authenticate via curl
curl -X POST \
-H "Content-Type: application/json" \
-d '{"role_id":"'$ROLE_ID'","secret_id":"'$SECRET_ID'"}' \
$VAULT_ADDR/v1/auth/GloboAppRole/login | jq

External Authentication Sources

Popular External Methods

GitHub Authentication:

• Perfect for developer access scenarios
• Uses GitHub personal access tokens
• Can map GitHub teams to Vault policies
• Ideal for mixed internal/external developer teams

LDAP/Active Directory:

• Enterprise standard for user authentication
• Leverages existing identity infrastructure
• Supports group-based policy mapping
• Requires network connectivity to LDAP server

Cloud Provider Authentication:

• AWS - IAM roles, EC2 instance profiles
• Azure - Managed identities, service principals
• GCP - Service accounts, compute engine identities
• Perfect for cloud-native applications

Implementation Considerations

🎯 Best Practices:

• Multiple Methods - Enable different methods for different use cases
• Path Planning - Choose meaningful paths (cannot be changed later)
• Security Constraints - Use CIDR, TTL, and usage limits for AppRole
• External Dependencies - Ensure availability of external auth sources
• Token Management - Understand token lifecycle and renewal

Advanced AppRole Security Features

Security Constraints

• secret_id_bound_cidrs - Restrict SecretID usage to specific IP ranges
• secret_id_num_uses - Limit how many times a SecretID can be used
• secret_id_ttl - Set expiration time for SecretIDs
• token_num_uses - Limit token usage count
• token_ttl - Set token lifetime

Example with Security Constraints:

vault write auth/approle/role/secure-webapp \
role_name=secure-webapp \
secret_id_bound_cidrs="10.0.0.0/8,192.168.0.0/16" \
secret_id_num_uses=1 \
secret_id_ttl=2h \
token_num_uses=10 \
token_ttl=1h

Troubleshooting Authentication

Common Issues and Solutions

AppRole SecretID Exhausted:

Error: "invalid secret id"
Cause: SecretID used up (secret_id_num_uses=1)
Solution: Generate new SecretID before each authentication

Authentication Method Not Found:

Error: "no handler for route"
Cause: Method not enabled or wrong path
Solution: Verify with vault auth list

Key Takeaways & Next Steps

Essential Concepts

• Authentication Purpose - All methods ultimately provide tokens for Vault access
• Method Selection - Choose based on client type, environment, and existing infrastructure
• Internal vs External - Internal methods are simpler but require separate management
• Path Management - Plan paths carefully as they cannot be changed after enabling
• Security Constraints - Use AppRole constraints for robust machine authentication

Command Summary

Management: vault auth [list|enable|tune|disable]
Interactive Login: vault login -method=[method]
Programmatic Auth: vault write auth/[path]/login
Help: vault path-help auth/[path]

What's Next?

Now that you can authenticate to Vault, the next crucial step is understanding policies - they define what authenticated users can actually do inside Vault. Policies govern access control and determine permissions for secrets, configuration, and administrative operations.

🎯 Practice Challenge:
Set up a complete authentication scenario:

1. Enable userpass for human operators
2. Enable AppRole for application access
3. Configure security constraints for AppRole
4. Test authentication via CLI, UI, and API
5. Practice token lifecycle management

Ready for the next level? Understanding authentication is the foundation for implementing comprehensive Vault security. The next step is mastering policies to control what authenticated entities can access and modify within your Vault infrastructure.