Integrating SailPoint with HashiCorp Vault Integration (On-Premise)

This document provides the requirements and field definitions you need to configure a HashiCorp Vault Integration (On-Premise) connector.

Use the connector to discover and aggregate non-human identities (NHIs) from on-premises HashiCorp Vault (Community version) into SailPoint. The connector aggregates Vault token metadata and userpass account metadata.

Note

This is a SailPoint source connector. It is not the HashiCorp Vault Credential Provider.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Feature	Description
Test connection	Validates the connection to HashiCorp Community Vault.
Dataset aggregation	Aggregation Tokens and UserPass Accounts

Note

Your organization must have SailPoint Agentic Fabric to use this connector. Contact your Customer Success team for more information.

For more information, refer to SailPoint Agentic Fabric.

Non-Human Identity Discovery

Aggregate Vault tokens and UserPass accounts

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Supported Managed Systems

The HashiCorp Vault Integration (On-Premise) source supports the following managed systems:

HashiCorp Vault Community edition, deployed on-premises

Prerequisites

Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

Before you configure the HashiCorp Vault Integration (On-Premise) source, create a Vault ACL policy and a Vault token.

Creating the Vault ACL Policy

Create a Vault ACL policy that grants the permissions listed in Required Permissions.
Save the policy and record its name.

Creating the Vault Token

Run the following command. Replace <policy-name> with the ACL policy name.
```
vault write auth/token/create policies=<policy-name> period="720h" renewable=true
```
The connector does not automatically regenerate an expired token. Configure the token's period. If you do not configure a period, the default is 32 days. If a token expires, you can manually renew it.
Copy the token value and store it securely.
Use the token value for API Token when you configure the source.

Required Permissions

Grant the Vault token a policy with the following minimum read permissions. Create this policy before you create the token.

path "*" {
  capabilities = ["list", "read"]
}
path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}
path "auth/token/accessors" {
  capabilities = ["list", "sudo"]
}
path "auth/token/renew-self" {
  capabilities = ["update"]
}

Each rule supports the following connector operations.

Path	Capabilities	Purpose
`*`	`list`, `read`	Reads the authentication mounts and userpass account metadata the connector aggregates.
`auth/token/lookup-accessor`	`update`	Looks up the metadata for each token accessor.
`auth/token/accessors`	`list`, `sudo`	Lists the token accessors available in the Vault instance.
`auth/token/renew-self`	`update`	Renews the connector's own token so the connection remains valid.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.