Skip to main content
This article covers both HashiCorp Vault connectors. The standard connector is read-only and authenticates with a static token. The HashiCorp Vault (Multi-Auth) connector adds provisioning and two more authentication methods, Username & Password and AppRole.
The HashiCorp Vault (Multi-Auth) connector is in Early Access. Contact your Lumos team to have it enabled for your domain.

​
After this article

You’ll be able to connect HashiCorp Vault to Lumos to bring Vault entities, identity groups, and policies into your access visibility. With the HashiCorp Vault (Multi-Auth) connector you can also create, deactivate, reactivate, and delete entities and assign or unassign identity groups and policies from Lumos.

​
Capabilities

Custom attributes: the Multi-Auth connector syncs entity metadata as custom attributes.

​
Required plan and roles

Connect HashiCorp Vault with credentials from your Vault instance. Generate them as a Vault administrator, then enter them on the connector card in Lumos.

​
Read-only access vs provisioning

Is read-only possible? Yes. The standard HashiCorp Vault connector is read-only. The HashiCorp Vault (Multi-Auth) connector can provision; to keep it read-only, give its credential a policy with only read and list on the paths below. What full provisioning requires. The HashiCorp Vault (Multi-Auth) connector, authenticated with a static token, a Vault username and password, or an AppRole (Role ID and Secret ID), whose policy also allows create, update, and delete on identity/entity/*, identity/group/*, and sys/policy/*. Watch out for. Each credential is validated when you connect, so a policy missing a path fails at Connect rather than during a later sync. With AppRole, Lumos logs in and obtains a short-lived token for every sync. Optionally set Email Metadata Field to the entity metadata key that holds each user’s email, and Namespace if you use Vault Enterprise namespaces.

​
Instructions

Phase 1: Prepare Vault credentials
  1. Log in to your HashiCorp Vault instance as an administrator.
  2. Gather Token
    1. The token to use for authentication with the Vault UI or REST API. Management of tokens is automatically available in the API at ‘/auth/token’ endpoints, but token creation requires authentication with administrator privileges. Contact your Vault administrator to obtain a token. The provided token must have a policy assigned that allows the following actions: sys/health: read identity/entity/: create, read, update, list identity/group/: create, read, update, list sys/policy/: create, read, update, list auth/approle/role/: create, read, update, list For more information about policies, see: https://developer.hashicorp.com/vault/docs/concepts/policies
  3. Gather Hostname The hostname of the HashiCorp Vault’s REST API. This is the URL that will be used to connect to the Vault API. You can find this in Vault server configuration under ‘Api Address’. For example, if the API address is ‘https://vault.example.com:8200’, the hostname is ‘vault.example.com:8200’, do not include the http protocol.
Phase 2: Connect in Lumos
  1. Find the HashiCorp Vault card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter your Vault credentials.
  3. Click Connect.