Configuring HashiCorp Vault (On-Premise)

Base Configuration

Provide the base configuration parameters. Information you entered during the initial creation of the credential provider is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Go to Admin > Connections > Credential Providers.
2. Search for the credential provider you want to edit.
3. Enter a unique Credential Provider Name.
4. Enter a Credential Provider Description that provides details necessary to distinguish it from similar credential providers.
5. Select a Credential Provider Owner by typing the owner's name into the field provided. Matches display after you type at least two letters. Select the credential provider owner as required.
6. Select a Virtual Appliance Cluster with connectivity to the credential provider. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
7. Select Save.

Connection Settings

Configure the authentication parameters to connect to and authenticate with the HashiCorp Vault (On-Premise) host.

1. Enter the Host URL for the HashiCorp Vault (On-Premise) secret server.

2. Enter the URL-encoded Namespace path to use for the HashiCorp Vault (On-Premise) secret server.

   Important

   Don't encode the last slash (/) in your Namespace. For example, if your Namespace is xyz/pqr abcd/, then encode only xyz/pqr abcd.

   Tip

   Use urlencoder.org to encode your URL attributes.

3. Under Authentication Type, select either Userpass, AppRole, or JWT. Then, enter the supporting information required to complete the authentication. Select one of the following to complete the authentication setup:

   • Userpass
   • AppRole
   • JWT

Userpass

Configure userpass authentication to complete the connection setup.

1. In the HashiCorp Vault (On-Premise) server, enable the Userpass authentication method and add the required users in it. The users should have permission to fetch the secrets.

2. In SailPoint, enter the configuration parameters to use the HashiCorp Userpass authentication.

   1. Enter the URL-encoded Authentication Provider Path used to authenticate with the HashiCorp Vault (On-Premise) secret server.

      Important

      Don't encode the last slash (/) in your Authentication Provider path. For example, if your Authentication Provider path is xyz/pqr abcd/, then encode only xyz/pqr abcd.

      Tip

      Use urlencoder.org to encode your URL attributes.

   2. Enter the Username and Password to authenticate with HashiCorp Vault (On-Premise).

   3. (Optional) Enable credential caching. For more information, refer to Caching Credentials.
   4. Select Save.

AppRole

Configure AppRole authentication to complete the connection setup.

1. Do the following in the HashiCorp Vault (On-Premise) server to configure the authentication role:

   1. Enable the AppRole authentication using the following command:

      vault auth enable approle
      

   2. Create a new role for the AppRole authentication method using the HashiCorp API. Be sure to add the required policies for AppRole to access the secrets. For more information, refer to Create/Update AppRole in the HashiCorp documentation.

   3. Read the role ID for the new role using the HashiCorp API. For more information, refer to Read AppRole role ID in the HashiCorp documentation.

   4. Create a secret ID for the new role using the HashiCorp API. For more information, refer to Generate new secret ID in the HashiCorp documentation.

      Important

      While creating the secret ID, keep the values for num_uses and ttl set to 0.

2. In SailPoint, enter the configuration parameters to use the HashiCorp AppRole authentication.

   1. Enter the URL-encoded Authentication Provider Path used to authenticate with the HashiCorp Vault (On-Premise) secret server.

      Important

      Don't encode the last slash (/) in your Authentication Provider path. For example, if your Authentication Provider path is xyz/pqr abcd/, then encode only xyz/pqr abcd.

      Tip

      Use urlencoder.org to encode your URL attributes.

   2. Enter the Role ID and its Secret ID created in the HashiCorp Vault (On-Premise) server.

   3. (Optional) Enable credential caching. For more information, refer to Caching Credentials.
   4. Select Save.

JWT

Configure JWT authentication to complete the connection setup.

1. Do the following in the HashiCorp Vault (On-Premise) server to configure JWT authentication:

   1. Enable JWT authentication using the HashiCorp API. For more information, refer to JWT/OIDC auth method (API) in the HashiCorp documentation. Provide the following while enabling JWT:

      • jwt_validation_pubkeys - Public key required for JWT.
      • bound_issuer - Required issuer value.

      • jwt_supported_algs - RS256.

        Note

        RS256 is the only supported algorithm.

   2. Create a role for JWT authentication using the HashiCorp API. For more information, refer to Create/Update role in the HashiCorp documentation. Provide the following values while configuring the role:

      • bound_subject - Required subject value for authentication.
      • user_claim - Required user claim.
      • bound_audiences - Required value for the aud claim.
      • role_type - JWT.
      • policies - Provide required policies to fetch the secrets.
   3. In SailPoint, enter the configuration parameters to use HashiCorp JWT authentication.

   4. Enter the URL-encoded Authentication Provider Path used to authenticate with the HashiCorp Vault (On-Premise) secret server.

      Important

      Don't encode the last slash (/) in your Authentication Provider path. For example, if your Authentication Provider path is xyz/pqr abcd/, then encode only xyz/pqr abcd.

      Tip

      Use urlencoder.org to encode your URL attributes.

   5. Enter the name of the JWT Role.

   6. Enter the User Claim for JWT.
   7. Enter the User Claim Value.
   8. In the Subject field, enter the bound_subject value for the JWT role.
   9. In the Issuer field, enter the bound_issuer value for JWT authorization.
   10. In the Audience field, enter the bound_audiences value for the JWT role.

   11. Enter the Private Key used to assert the JWT.

       Note

       The private key should be in standard PKCS #1 format. Currently, SailPoint doesn't support private keys in PKCS #8 format.

   12. Enter the Private Key Password.

       Note

       This is only required if the private key is encrypted with a passphrase.

       1. (Optional) Enable credential caching. For more information, refer to Caching Credentials.
       2. Select Save.

Additional Settings

Configure settings related to how the connector handles dynamic secrets, as well as additional encryption for secrets while in transport.

Credential Wait Time

Some generated dynamic secrets may require additional time to activate at endpoint systems. These endpoint systems may include Microsoft Azure or Amazon Web Services, among others. To compensate for this additional time requirement, configure an additional wait time:

1. In the Credential Wait Time in Seconds field, enter the duration the credential provider should wait in seconds. The default is 10 seconds and the maximum is 90 seconds. The recommended value should be greater than 10 seconds, though the value may vary for end system configurations.
2. Select Save.

Response Wrapping

Response wrapping adds an extra layer of security to the secret information during transport processes. To use response wrapping:

1. Select Enable Response Wrapping. The Response Wrapping TTL in Seconds field displays.
2. In the Response Wrapping TTL in Seconds field, define the response wrapping time-to-live in seconds. The default value is 10 seconds. The minimum value is 10 seconds and the maximum value is 30 seconds.
3. Select Save.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.