Secret
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const config = new vault.ad.SecretBackend("config", {
backend: "ad",
binddn: "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
bindpass: "SuperSecretPassw0rd",
url: "ldaps://ad",
insecureTls: true,
userdn: "CN=Users,DC=corp,DC=example,DC=net",
});import pulumi
import pulumi_vault as vault
config = vault.ad.SecretBackend("config",
backend="ad",
binddn="CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
bindpass="SuperSecretPassw0rd",
url="ldaps://ad",
insecure_tls=True,
userdn="CN=Users,DC=corp,DC=example,DC=net")using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var config = new Vault.AD.SecretBackend("config", new()
{
Backend = "ad",
Binddn = "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
Bindpass = "SuperSecretPassw0rd",
Url = "ldaps://ad",
InsecureTls = true,
Userdn = "CN=Users,DC=corp,DC=example,DC=net",
});
});package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/ad"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := ad.NewSecretBackend(ctx, "config", &ad.SecretBackendArgs{
Backend: pulumi.String("ad"),
Binddn: pulumi.String("CN=Administrator,CN=Users,DC=corp,DC=example,DC=net"),
Bindpass: pulumi.String("SuperSecretPassw0rd"),
Url: pulumi.String("ldaps://ad"),
InsecureTls: pulumi.Bool(true),
Userdn: pulumi.String("CN=Users,DC=corp,DC=example,DC=net"),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.ad.SecretBackend;
import com.pulumi.vault.ad.SecretBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var config = new SecretBackend("config", SecretBackendArgs.builder()
.backend("ad")
.binddn("CN=Administrator,CN=Users,DC=corp,DC=example,DC=net")
.bindpass("SuperSecretPassw0rd")
.url("ldaps://ad")
.insecureTls("true")
.userdn("CN=Users,DC=corp,DC=example,DC=net")
.build());
}
}resources:
config:
type: vault:ad:SecretBackend
properties:
backend: ad
binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net
bindpass: SuperSecretPassw0rd
url: ldaps://ad
insecureTls: 'true'
userdn: CN=Users,DC=corp,DC=example,DC=netImport
AD secret backend can be imported using the backend, e.g.
$ pulumi import vault:ad/secretBackend:SecretBackend ad adConstructors
Properties
Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).
If set, user and group names assigned to policies within the backend will be case sensitive. Otherwise, names will be normalized to lower case.
CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
Client certificate to provide to the LDAP server, must be x509 PEM encoded.
Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
Default lease duration for secrets in seconds.
Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true.
Human-friendly description of the mount for the Active Directory backend.
If set, opts out of mount migration on path updates. See here for more info on Mount Migration
Use anonymous bind to discover the bind Distinguished Name of a user.
Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username. Defaults to (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))
Skip LDAP server SSL Certificate verification. This is not recommended for production. Defaults to false.
The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band
Maximum possible lease duration for secrets in seconds.
Name of the password policy to use to generate passwords.
Timeout, in seconds, for the connection when making requests against the server before returning back an error.
Maximum TLS version to use. Accepted values are tls10, tls11, tls12 or tls13. Defaults to tls12.
Minimum TLS version to use. Accepted values are tls10, tls11, tls12 or tls13. Defaults to tls12.
In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations.
If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.