Auth Backend
Provides a resource for managing an LDAP auth backend within Vault.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const ldap = new vault.ldap.AuthBackend("ldap", {
path: "ldap",
url: "ldaps://dc-01.example.org",
userdn: "OU=Users,OU=Accounts,DC=example,DC=org",
userattr: "sAMAccountName",
upndomain: "EXAMPLE.ORG",
discoverdn: false,
groupdn: "OU=Groups,DC=example,DC=org",
groupfilter: "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
rotationSchedule: "0 * * * SAT",
rotationWindow: 3600,
});
import pulumi
import pulumi_vault as vault
ldap = vault.ldap.AuthBackend("ldap",
path="ldap",
url="ldaps://dc-01.example.org",
userdn="OU=Users,OU=Accounts,DC=example,DC=org",
userattr="sAMAccountName",
upndomain="EXAMPLE.ORG",
discoverdn=False,
groupdn="OU=Groups,DC=example,DC=org",
groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
rotation_schedule="0 * * * SAT",
rotation_window=3600)
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var ldap = new Vault.Ldap.AuthBackend("ldap", new()
{
Path = "ldap",
Url = "ldaps://dc-01.example.org",
Userdn = "OU=Users,OU=Accounts,DC=example,DC=org",
Userattr = "sAMAccountName",
Upndomain = "EXAMPLE.ORG",
Discoverdn = false,
Groupdn = "OU=Groups,DC=example,DC=org",
Groupfilter = "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
RotationSchedule = "0 * * * SAT",
RotationWindow = 3600,
});
});
package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/ldap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := ldap.NewAuthBackend(ctx, "ldap", &ldap.AuthBackendArgs{
Path: pulumi.String("ldap"),
Url: pulumi.String("ldaps://dc-01.example.org"),
Userdn: pulumi.String("OU=Users,OU=Accounts,DC=example,DC=org"),
Userattr: pulumi.String("sAMAccountName"),
Upndomain: pulumi.String("EXAMPLE.ORG"),
Discoverdn: pulumi.Bool(false),
Groupdn: pulumi.String("OU=Groups,DC=example,DC=org"),
Groupfilter: pulumi.String("(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))"),
RotationSchedule: pulumi.String("0 * * * SAT"),
RotationWindow: pulumi.Int(3600),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.ldap.AuthBackend;
import com.pulumi.vault.ldap.AuthBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var ldap = new AuthBackend("ldap", AuthBackendArgs.builder()
.path("ldap")
.url("ldaps://dc-01.example.org")
.userdn("OU=Users,OU=Accounts,DC=example,DC=org")
.userattr("sAMAccountName")
.upndomain("EXAMPLE.ORG")
.discoverdn(false)
.groupdn("OU=Groups,DC=example,DC=org")
.groupfilter("(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))")
.rotationSchedule("0 * * * SAT")
.rotationWindow(3600)
.build());
}
}
resources:
ldap:
type: vault:ldap:AuthBackend
properties:
path: ldap
url: ldaps://dc-01.example.org
userdn: OU=Users,OU=Accounts,DC=example,DC=org
userattr: sAMAccountName
upndomain: EXAMPLE.ORG
discoverdn: false
groupdn: OU=Groups,DC=example,DC=org
groupfilter: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))
rotationSchedule: 0 * * * SAT
rotationWindow: 3600
Import
LDAP authentication backends can be imported using the path
, e.g.
$ pulumi import vault:ldap/authBackend:AuthBackend ldap ldap
Properties
Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
Trusted CA to validate TLS certificate
Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in url
(integer: 30)
Prevents users from bypassing authentication when providing an empty password.
Description for the LDAP auth backend mount
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
If set, opts out of mount migration on path updates. See here for more info on Mount Migration
Use anonymous bind to discover the bind DN of a user.
Go template used to construct group membership query
Control whether or TLS certificates must be validated
Sets the max page size for LDAP lookups, by default it's set to -1. Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+.
The amount of time in seconds Vault should wait before rotating the root credential. A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
The schedule, in cron-style time format, defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
The maximum amount of time in seconds allowed to complete a rotation when a scheduled token rotation occurs. The default rotation window is unbound and the minimum allowable window is 3600
. Requires Vault Enterprise 1.19+.
Maximum acceptable version of TLS
Minimum acceptable version of TLS
Specifies the blocks of IP addresses which are allowed to use the generated token
Generated Token's Explicit Maximum TTL in seconds
The maximum lifetime of the generated token
If true, the 'default' policy will not automatically be added to generated tokens
The maximum number of times a token may be used, a value of zero means unlimited
Generated Token's Period
Generated Token's Policies
LDAP user search filter
Force the auth method to use the username passed by the user as the alias name.
Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships