# Integrating SailPoint with HashiCorp Vault Integration (On-Premise)

This document provides the requirements and field definitions you need to configure a HashiCorp Vault Integration (On-Premise) connector.

Use the connector to discover and aggregate non-human identities (NHIs) from on-premises HashiCorp Vault (Community version) into SailPoint. The connector aggregates Vault token metadata and userpass account metadata.

> [!NOTE]
>
> This is a SailPoint source connector. It is not the HashiCorp Vault Credential Provider.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates the connection to HashiCorp Community Vault. |
| Dataset aggregation | Aggregation Tokens and UserPass Accounts |

> [!NOTE]
>
> Your organization must have SailPoint Agentic Fabric to use this connector. Contact your Customer Success team for more information.
>
> For more information, refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Non-Human Identity Discovery

- Aggregate Vault tokens and UserPass accounts

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Managed Systems

The HashiCorp Vault Integration (On-Premise) source supports the following managed systems:

- HashiCorp Vault Community edition, deployed on-premises

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

Before you configure the HashiCorp Vault Integration (On-Premise) source, create a Vault ACL policy and a Vault token.

### Creating the Vault ACL Policy

1. Create a Vault ACL policy that grants the permissions listed in [Required Permissions](<#required-permissions>).
2. Save the policy and record its name.

### Creating the Vault Token

1. Run the following command. Replace `<policy-name>` with the ACL policy name.

   ```text
   vault write auth/token/create policies=<policy-name> period="720h" renewable=true
   ```

   The connector does not automatically regenerate an expired token. Configure the token's period. If you do not configure a period, the default is 32 days. If a token expires, you can manually renew it.
2. Copy the token value and store it securely.
3. Use the token value for **API Token** when you configure the source.

## Required Permissions

Grant the Vault token a policy with the following minimum read permissions. Create this policy before you create the token.

```text
path "*" {
  capabilities = ["list", "read"]
}
path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}
path "auth/token/accessors" {
  capabilities = ["list", "sudo"]
}
path "auth/token/renew-self" {
  capabilities = ["update"]
}
```

Each rule supports the following connector operations.

| Path | Capabilities | Purpose |
| --- | --- | --- |
| `*` | `list`, `read` | Reads the authentication mounts and userpass account metadata the connector aggregates. |
| `auth/token/lookup-accessor` | `update` | Looks up the metadata for each token accessor. |
| `auth/token/accessors` | `list`, `sudo` | Lists the token accessors available in the Vault instance. |
| `auth/token/renew-self` | `update` | Renews the connector's own token so the connection remains valid. |