# Configuring HashiCorp Vault (Cloud)

## Base Configuration

Provide the base configuration parameters. Information you entered during the initial creation of the credential provider is automatically entered into the fields in the **Base Configuration** page. You can edit this information if necessary.

> [!NOTE]
>
> **Screenshot**
>
> [![Base Configuration](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/base_config.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/base_config.png>)

> [!NOTE]
>
> Ensure that the name and description of each credential provider is unique.

1. Go to **Admin \> Connections \> Credential Providers**.
2. Search for the credential provider you want to edit.
3. Enter a unique **Credential Provider Name**.
4. Enter a **Credential Provider Description** that provides details necessary to distinguish it from similar credential providers.
5. Select a **Credential Provider Owner** by typing the owner's name into the field provided. Matches display after you type at least two letters. Select the credential provider owner as required.
6. Select a **Virtual Appliance Cluster** with connectivity to the credential provider. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
7. Select **Save**.

## Connection Settings

Configure the authentication parameters to connect to and authenticate with the HashiCorp Vault (Cloud) host.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/connection_settings.png>)

1. Enter the **Host URL** for the HashiCorp Vault (Cloud) secret server.

   > **Note**
   >
   > The HashiCorp Host URL should be accessible from VA.
2. Enter the URL-encoded **Namespace** path to use for the HashiCorp Vault (Cloud) secret server.

   > **Important**
   >
   > Don't encode the last slash (`/`) in your Namespace. For example, if your Namespace is `xyz/pqr abcd/`, then encode only `xyz/pqr abcd`.

   > **Tip**
   >
   > Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.
3. Under **Authentication Type**, select either **Userpass**, **AppRole**, or **JWT**. Then, enter the supporting information required to complete the authentication. Select one of the following to complete the authentication setup:

   - [Userpass](<#userpass>)
   - [AppRole](<#approle>)
   - [JWT](<#jwt>)

### Userpass

Configure userpass authentication to complete the connection setup.

> [!NOTE]
>
> **Screenshot**
>
> [![Userpass](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_userpass.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_userpass.png>)

1. In the HashiCorp Vault (Cloud) server, enable the Userpass authentication method and add the required users in it. The users should have permission to fetch the secrets.
2. In SailPoint, enter the configuration parameters to use the HashiCorp Userpass authentication.

   1. Enter the URL-encoded **Authentication Provider Path** used to authenticate with the HashiCorp Vault (Cloud) secret server.

      > **Important**
      >
      > Don't encode the last slash (`/`) in your Authentication Provider path. For example, if your Authentication Provider path is `xyz/pqr abcd/`, then encode only `xyz/pqr abcd`.

      > **Tip**
      >
      > Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.
   2. Enter the **Username** and **Password** to authenticate with HashiCorp Vault (Cloud).
   3. Select **Save**.

### AppRole

Configure AppRole authentication to complete the connection setup.

> [!NOTE]
>
> The linked documents on this page are not maintained by SailPoint and are subject to change without notice.

> [!NOTE]
>
> **Screenshot**
>
> [![AppRole](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_approle.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_approle.png>)

1. Do the following in the HashiCorp Vault (Cloud) server to configure the authentication role:

   1. Enable the AppRole authentication using the following command:

      ```text
      vault auth enable approle
      ```
   2. Create a new role for the AppRole authentication method using the HashiCorp API. Be sure to add the required policies for AppRole to access the secrets. For more information, refer to [Create/Update AppRole](<https://developer.hashicorp.com/vault/api-docs/auth/approle#create-update-approle>) in the HashiCorp documentation.
   3. Read the role ID for the new role using the HashiCorp API. For more information, refer to [Read AppRole role ID](<https://developer.hashicorp.com/vault/api-docs/auth/approle#read-approle-role-id>) in the HashiCorp documentation.
   4. Create a secret ID for the new role using the HashiCorp API. For more information, refer to [Generate new secret ID](<https://developer.hashicorp.com/vault/api-docs/auth/approle#generate-new-secret-id>) in the HashiCorp documentation.

      > **Important**
      >
      > While creating the secret ID, keep the values for `num_uses` and `ttl` set to `0`.
2. In SailPoint, enter the configuration parameters to use the HashiCorp AppRole authentication.

   1. Enter the URL-encoded **Authentication Provider Path** used to authenticate with the HashiCorp Vault (Cloud) secret server.

      > **Important**
      >
      > Don't encode the last slash (`/`) in your Authentication Provider path. For example, if your Authentication Provider path is `xyz/pqr abcd/`, then encode only `xyz/pqr abcd`.

      > **Tip**
      >
      > Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.
   2. Enter the **Role ID** and its **Secret ID** created in the HashiCorp Vault (Cloud) server.
   3. Select **Save**.

### JWT

Configure JWT authentication to complete the connection setup.

> [!NOTE]
>
> The linked documents on this page are not maintained by SailPoint and are subject to change without notice.

> [!NOTE]
>
> **Screenshot**
>
> [![JWT](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_jwt.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/auth_jwt.png>)

1. Do the following in the HashiCorp Vault (Cloud) server to configure JWT authentication:

   1. Enable JWT authentication using the HashiCorp API. For more information, refer to [JWT/OIDC auth method (API)](<https://developer.hashicorp.com/vault/api-docs/auth/jwt>) in the HashiCorp documentation. Provide the following while enabling JWT:

      - `jwt_validation_pubkeys` - Public key required for JWT.
      - `bound_issuer` - Required issuer value.
      - `jwt_supported_algs` - `RS256`.

        > **Note**
        >
        > RS256 is the only supported algorithm.
   2. Create a role for JWT authentication using the HashiCorp API. For more information, refer to [Create/Update role](<https://developer.hashicorp.com/vault/api-docs/auth/jwt#create-update-role>) in the HashiCorp documentation. Provide the following values while configuring the role:

      - `bound_subject` - Required subject value for authentication.
      - `user_claim` - Required `user` claim.
      - `bound_audiences` - Required value for the `aud` claim.
      - `role_type` - `JWT`.
      - `policies` - Provide required policies to fetch the secrets.
   3. In SailPoint, enter the configuration parameters to use HashiCorp JWT authentication.
   4. Enter the URL-encoded **Authentication Provider Path** used to authenticate with the HashiCorp Vault (Cloud) secret server.

      > **Important**
      >
      > Don't encode the last slash (`/`) in your Authentication Provider path. For example, if your Authentication Provider path is `xyz/pqr abcd/`, then encode only `xyz/pqr abcd`.

      > **Tip**
      >
      > Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.
   5. Enter the name of the **JWT Role**.
   6. Enter the **User Claim for JWT**.
   7. Enter the **User Claim Value**.
   8. In the **Subject** field, enter the `bound_subject` value for the JWT role.
   9. In the **Issuer** field, enter the `bound_issuer` value for JWT authorization.
   10. In the **Audience** field, enter the `bound_audiences` value for the JWT role.
   11. Enter the **Private Key** used to assert the JWT.

       > **Note**
       >
       > The private key should be in standard PKCS \#1 format. Currently, SailPoint doesn't support private keys in PKCS \#8 format.
   12. Enter the **Private Key Password**.

       > **Note**
       >
       > This is only required if the private key is encrypted with a passphrase.
2. Select **Save**.

## Additional Settings

Configure settings related to how the connector handles dynamic secrets, as well as additional encryption for secrets while in transport.

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/hashicorp_cloud/help/img/additional_settings.png>)

### Credential Wait Time

Some generated dynamic secrets may require additional time to activate at endpoint systems. These endpoint systems may include Microsoft Azure or Amazon Web Services, among others. To compensate for this additional time requirement, configure an additional wait time:

1. In the **Credential Wait Time in Seconds** field, enter the duration the credential provider should wait in seconds. The default is 10 seconds and the maximum is 90 seconds. The recommended value should be greater than 10 seconds, though the value may vary for end system configurations.
2. Select **Save**.

### Response Wrapping

Response wrapping adds an extra layer of security to the secret information during transport processes. To use response wrapping:

1. Select **Enable Response Wrapping**. The **Response Wrapping TTL in Seconds** field displays.
2. In the **Response Wrapping TTL in Seconds** field, define the response wrapping time-to-live in seconds. The default value is 10 seconds. The minimum value is 10 seconds and the maximum value is 30 seconds.
3. Select **Save**.