Search code examples
hashicorp-vault

Use LDAP username as the entity name

I'm using Hashicorp Vault 1.9.0 and I enabled the LDAP authentication method which is working correctly as expected, but I have an issue:

The LDAP is our unique authentication method (besides the Token one, of course) and the LDAP users were NOT created in Vault in advance. So, when some user signs in to Vault for the first time, Vault creates the user entity automatically, with a generic name like, for example, "entity_1fb81714" and adds the LDAP username as an alias for the entity. This is working pretty well (but could be better). Is there a way to configure Vault to use the LDAP username (the same used in the alias) to be the entity name, instead of the generic "entity_xxx" one?

Entity name:

enter image description here

Entity alias:

enter image description here

Solution

  • It can be done, but you might give up when you see the maintenance involved...

    So you have an entity with a random name, "inside" which there is a entity-alias with the sAMAccountName attribute of a given user.

    Background

    Entity creation is not done by the ldap auth backend. An entity will be created if Vault can't find an existing entity with a matching entity alias.

    So basically it does this:

    1. Try to find an existing entity with that alias in it
    2. Create a new entity if none is found

    The problem is that Vault can't use the entity alias attribute value as a name, because you can have multiple entity alias for any given entity. Other auth backends (like Github) could have a different entity alias attribute. Vault is not in position to decide which one it should use so a random name is chosen.

    It can be done

    To have predictable names for your entities, you would have to create the entity with the name of your choice and the alias in advance, so that it is present when the user first logs in and Vault goes looking for it.

    I would suggest that you learn to live with random names for three reasons:

    1. Management
    2. Race conditions
    3. License cost

    Management

    You will have to poll your Active Directory for changes and create/delete entity alias as users come and go. Keep in mind that Vault will not validate the entity alias is valid, that's your job. Not a complex piece of code, but it won't write and maintain itself and you probably have better things to do.

    Race conditions

    Even with a synchronisation mechanism in place, there is still a change a user logs in Vault between two passes of your script. That user will get a random entity name. You script could account for that and fix it on the next run, but it will make your synchronization code more complex.

    Licenses

    Vault Enterprise is licensed per entity. Creating an entity alias for everyone in your Active Directory could get expensive. Your script could account for that too, creating entity alias for members of a given group only, but... you get the idea.

    You might were this is going: if you want to control the entity name