> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HashiCorp Vault

*This article covers both HashiCorp Vault connectors. The standard connector is read-only and authenticates with a static token. The **HashiCorp Vault (Multi-Auth)** connector adds provisioning and two more authentication methods, Username & Password and AppRole.*

<Note>
  The HashiCorp Vault (Multi-Auth) connector is in Early Access. Contact your Lumos team to have it enabled for your domain.
</Note>

## After this article

You'll be able to connect HashiCorp Vault to Lumos to bring Vault entities, identity groups, and policies into your access visibility. With the HashiCorp Vault (Multi-Auth) connector you can also create, deactivate, reactivate, and delete entities and assign or unassign identity groups and policies from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | Yes (Multi-Auth only) | Vault identity entities. Lumos can create, deactivate, reactivate, and delete them |
| Groups | Permission | Yes | Yes (Multi-Auth only) | Identity groups. Lumos can add and remove entities |
| Roles | Permission | Yes | No | Roles |
| Policy | Permission | Yes | Yes (Multi-Auth only) | ACL and RGP policies. Lumos can assign and unassign them |

**Custom attributes:** the Multi-Auth connector syncs entity metadata as custom attributes.

## Required plan and roles

Connect HashiCorp Vault with credentials from your Vault instance. Generate them as a Vault administrator, then enter them on the connector card in Lumos.

## Read-only access vs provisioning

**Is read-only possible?** Yes. The standard HashiCorp Vault connector is read-only. The HashiCorp Vault (Multi-Auth) connector can provision; to keep it read-only, give its credential a policy with only `read` and `list` on the paths below.

**What full provisioning requires.** The HashiCorp Vault (Multi-Auth) connector, authenticated with a static token, a Vault username and password, or an AppRole (Role ID and Secret ID), whose policy also allows `create`, `update`, and `delete` on `identity/entity/*`, `identity/group/*`, and `sys/policy/*`.

**Watch out for.** Each credential is validated when you connect, so a policy missing a path fails at Connect rather than during a later sync. With AppRole, Lumos logs in and obtains a short-lived token for every sync. Optionally set **Email Metadata Field** to the entity metadata key that holds each user's email, and **Namespace** if you use Vault Enterprise namespaces.

## Instructions

**Phase 1: Prepare Vault credentials**

1. Log in to your HashiCorp Vault instance as an administrator.
2. **Gather Token**
   1. The token to use for authentication with the Vault UI or REST API. Management of tokens is automatically available in the API at '/auth/token' endpoints, but token creation requires authentication with administrator privileges. Contact your Vault administrator to obtain a token.
      The provided token must have a policy assigned that allows the following actions:
      sys/health: read identity/entity/*: create, read, update, list identity/group/*: create, read, update, list sys/policy/*: create, read, update, list auth/approle/role/*: create, read, update, list For more information about policies, see: [https://developer.hashicorp.com/vault/docs/concepts/policies](https://developer.hashicorp.com/vault/docs/concepts/policies)
3. **Gather Hostname** The hostname of the HashiCorp Vault's REST API. This is the URL that will be used to connect to the Vault API. You can find this in Vault server configuration under 'Api Address'. For example, if the API address is '[https://vault.example.com:8200](https://vault.example.com:8200)', the hostname is 'vault.example.com:8200', do not include the http protocol.

**Phase 2: Connect in Lumos**

1. Find the HashiCorp Vault card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter your Vault credentials.
3. Click **Connect**.