Configuring authentication methods

After you generate an admin token and complete initial setup of your Vault Dedicated instance, configure an authentication method so that your applications and teams can authenticate to Vault without depending on the admin token.

The admin token is intended for initial configuration and emergency access only. For day-to-day operations, use a dedicated authentication method.

Supported authentication methods

During the public beta, Vault Dedicated supports the following authentication methods:

Supported authentication methods for Vault Dedicated
Auth method Best for HashiCorp docs
Token Direct token-based authentication. Used for initial setup and for generating child tokens with scoped policies. Token auth method
AppRole Machine-to-machine authentication for applications and services. AppRole auth method
Userpass Username and password authentication for human users. Userpass auth method

Before you begin

Before you configure an authentication method, ensure that you have:

Enabling an auth method

Use the Vault CLI or API to enable an authentication method on your instance. The following example enables the AppRole auth method.

  1. Authenticate to your Vault Dedicated instance using your admin token.

    export VAULT_ADDR="https://<instance_id>.vault.<region>.secrets-manager.appdomain.cloud"
export VAULT_TOKEN="<admin_token>"

  2. Enable the auth method.

    vault auth enable approle

  3. Create a role with the appropriate policies attached.

    vault write auth/approle/role/my-app \
    token_policies="my-policy" \
    token_ttl=1h \
    token_max_ttl=4h

  4. Retrieve the Role ID and generate a Secret ID for your application.

    vault read auth/approle/role/my-app/role-id
vault write -f auth/approle/role/my-app/secret-id

For full configuration options and examples for each auth method, see the HashiCorp Vault auth methods documentation.

Next steps