Sync docs from master to gh-pages
This commit is contained in:
buildmaster
@@ -1,6 +1,6 @@
|
||||
<html><head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>3. Authentication methods</title><link rel="stylesheet" type="text/css" href="css/manual-multipage.css"><meta name="generator" content="DocBook XSL Stylesheets V1.79.1"><link rel="home" href="multi_spring-cloud-vault.html" title="Spring Cloud Vault"><link rel="up" href="multi_spring-cloud-vault.html" title="Spring Cloud Vault"><link rel="prev" href="multi__client_side_usage.html" title="2. Client Side Usage"><link rel="next" href="multi_vault.config.authentication.gcpgce.html" title="4. GCP-GCE authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">3. Authentication methods</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="multi__client_side_usage.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="multi_vault.config.authentication.gcpgce.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="vault.config.authentication" href="#vault.config.authentication"></a>3. Authentication methods</h1></div></div></div><p>Different organizations have different requirements for security
|
||||
<title>3. Authentication methods</title><link rel="stylesheet" type="text/css" href="css/manual-multipage.css"><meta name="generator" content="DocBook XSL Stylesheets V1.79.1"><link rel="home" href="multi_spring-cloud-vault.html" title="Spring Cloud Vault"><link rel="up" href="multi_spring-cloud-vault.html" title="Spring Cloud Vault"><link rel="prev" href="multi__client_side_usage.html" title="2. Client Side Usage"><link rel="next" href="multi_vault.config.backends.html" title="4. Secret Backends"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">3. Authentication methods</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="multi__client_side_usage.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="multi_vault.config.backends.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="vault.config.authentication" href="#vault.config.authentication"></a>3. Authentication methods</h1></div></div></div><p>Different organizations have different requirements for security
|
||||
and authentication. Vault reflects that need by shipping multiple authentication
|
||||
methods. Spring Cloud Vault supports token and AppId authentication.</p><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.token" href="#vault.config.authentication.token"></a>3.1 Token authentication</h2></div></div></div><p>Tokens are the core method for authentication within Vault.
|
||||
Token authentication requires a static token to be provided using the
|
||||
@@ -128,7 +128,7 @@ bound to a VM instance.</p><div class="example"><a name="d0e888" href="#d0e888">
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> azure-path</span>: aws</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the name of the role against which the login is being attempted.</li><li class="listitem"><code class="literal">azure-path</code> sets the path of the Azure mount to use</li></ul></div><p>Azure MSI authentication fetches environmental details about the virtual machine
|
||||
(subscription Id, resource group, VM name) from the instance metadata service.</p><p>See also: <a class="link" href="https://www.vaultproject.io/docs/auth/azure.html" target="_top">Vault Documentation: Using the azure auth backend</a></p></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.clientcert" href="#vault.config.authentication.clientcert"></a>3.7 TLS certificate authentication</h2></div></div></div><p>The <code class="literal">cert</code> auth backend allows authentication using SSL/TLS client
|
||||
certificates that are either signed by a CA or self-signed.</p><p>To enable <code class="literal">cert</code> authentication you need to:</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem">Use SSL, see <a class="xref" href="multi_vault.config.ssl.html" title="11. Vault Client SSL configuration">Chapter 11, <i>Vault Client SSL configuration</i></a></li><li class="listitem">Configure a Java <code class="literal">Keystore</code> that contains the client
|
||||
certificates that are either signed by a CA or self-signed.</p><p>To enable <code class="literal">cert</code> authentication you need to:</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem">Use SSL, see <a class="xref" href="multi_vault.config.ssl.html" title="9. Vault Client SSL configuration">Chapter 9, <i>Vault Client SSL configuration</i></a></li><li class="listitem">Configure a Java <code class="literal">Keystore</code> that contains the client
|
||||
certificate and the private key</li><li class="listitem">Set the <code class="literal">spring.cloud.vault.authentication</code> to <code class="literal">CERT</code></li></ol></div><div class="example"><a name="d0e947" href="#d0e947"></a><p class="title"><b>Example 3.15. bootstrap.yml</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: CERT
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> ssl</span>:
|
||||
@@ -147,4 +147,53 @@ wrapping_token_ttl: 0h10m0s
|
||||
wrapping_token_creation_time: 2016-09-18 20:29:48.652957077 +0200 CEST
|
||||
wrapped_accessor: 46b6aebb-187f-932a-26d7-4f3d86a68319</pre></div></div><br class="example-break"><div class="example"><a name="d0e975" href="#d0e975"></a><p class="title"><b>Example 3.17. bootstrap.yml</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: CUBBYHOLE
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> token</span>: <span class="hl-number">397</span>ccb93-ff6c-b17b-<span class="hl-number">9389</span>-<span class="hl-number">380</span>b01ca2645</pre></div></div><br class="example-break"><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/concepts/tokens.html" target="_top">Vault Documentation: Tokens</a></li><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/secrets/cubbyhole/index.html" target="_top">Vault Documentation: Cubbyhole Secret Backend</a></li><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/concepts/response-wrapping.html" target="_top">Vault Documentation: Response Wrapping</a></li></ul></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="multi__client_side_usage.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="multi_vault.config.authentication.gcpgce.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">2. Client Side Usage </td><td width="20%" align="center"><a accesskey="h" href="multi_spring-cloud-vault.html">Home</a></td><td width="40%" align="right" valign="top"> 4. GCP-GCE authentication</td></tr></table></div></body></html>
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> token</span>: <span class="hl-number">397</span>ccb93-ff6c-b17b-<span class="hl-number">9389</span>-<span class="hl-number">380</span>b01ca2645</pre></div></div><br class="example-break"><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/concepts/tokens.html" target="_top">Vault Documentation: Tokens</a></li><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/secrets/cubbyhole/index.html" target="_top">Vault Documentation: Cubbyhole Secret Backend</a></li><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/concepts/response-wrapping.html" target="_top">Vault Documentation: Response Wrapping</a></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.gcpgce" href="#vault.config.authentication.gcpgce"></a>3.9 GCP-GCE authentication</h2></div></div></div><p>The <a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">gcp</a>
|
||||
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p><p>GCP GCE (Google Compute Engine) authentication creates a signature in the form of a
|
||||
JSON Web Token (JWT) for a service account. A JWT for a Compute Engine instance
|
||||
is obtained from the GCE metadata service using <a class="link" href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity" target="_top">Instance identification</a>.
|
||||
This API creates a JSON Web Token that can be used to confirm the instance identity.</p><p>Unlike most Vault authentication backends, this backend
|
||||
does not require first-deploying, or provisioning security-sensitive
|
||||
credentials (tokens, username/password, client certificates, etc.).
|
||||
Instead, it treats GCP as a Trusted Third Party and uses the
|
||||
cryptographically signed dynamic metadata information that uniquely
|
||||
represents each GCP service account.</p><div class="example"><a name="d0e1010" href="#d0e1010"></a><p class="title"><b>Example 3.18. bootstrap.yml with required GCP-GCE Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_GCE
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-gce</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role</pre></div></div><br class="example-break"><div class="example"><a name="d0e1015" href="#d0e1015"></a><p class="title"><b>Example 3.19. bootstrap.yml with all GCP-GCE Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_GCE
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-gce</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-path</span>: gcp
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account</span>: my-service@projectid.iam.gserviceaccount.com</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the name of the role against which the login is being attempted.</li><li class="listitem"><code class="literal">gcp-path</code> sets the path of the GCP mount to use</li><li class="listitem"><code class="literal">service-account</code> allows overriding the service account Id to a specific value. Defaults to the <code class="literal">default</code> service account.</li></ul></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">Vault Documentation: Using the GCP auth backend</a></li><li class="listitem"><a class="link" href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity" target="_top">GCP Documentation: Verifying the Identity of Instances</a></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.gcpiam" href="#vault.config.authentication.gcpiam"></a>3.10 GCP-IAM authentication</h2></div></div></div><p>The <a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">gcp</a>
|
||||
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p><p>GCP IAM authentication creates a signature in the form of a JSON Web Token (JWT)
|
||||
for a service account. A JWT for a service account is obtained by
|
||||
calling GCP IAM’s <a class="link" href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt" target="_top"><code class="literal">projects.serviceAccounts.signJwt</code></a> API. The caller authenticates against GCP IAM
|
||||
and proves thereby its identity. This Vault backend treats GCP as a Trusted Third Party.</p><p>IAM credentials can be obtained from either the runtime environment
|
||||
, specifically the <a class="link" href="https://cloud.google.com/docs/authentication/production" target="_top"><code class="literal">GOOGLE_APPLICATION_CREDENTIALS</code></a>
|
||||
environment variable, the Google Compute metadata service,
|
||||
or supplied externally as e.g. JSON or base64 encoded.
|
||||
JSON is the preferred form as it carries the project id and
|
||||
service account identifier required for calling <code class="literal">projects.serviceAccounts.signJwt</code>.</p><div class="example"><a name="d0e1073" href="#d0e1073"></a><p class="title"><b>Example 3.20. bootstrap.yml with required GCP-IAM Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_IAM
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-iam</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role</pre></div></div><br class="example-break"><div class="example"><a name="d0e1078" href="#d0e1078"></a><p class="title"><b>Example 3.21. bootstrap.yml with all GCP-IAM Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_IAM
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-iam</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> credentials</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> location</span>: classpath:credentials.json
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> encoded-key</span>: e+KApn0=
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-path</span>: gcp
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> jwt-validity</span>: <span class="hl-number">15</span>m
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> project-id</span>: my-project-id
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account</span>: my-service@projectid.iam.gserviceaccount.com</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the name of the role against which the login is being attempted.</li><li class="listitem"><code class="literal">credentials.location</code> path to the credentials resource that contains Google credentials in JSON format.</li><li class="listitem"><code class="literal">credentials.encoded-key</code> the base64 encoded contents of an OAuth2 account private key in the JSON format.</li><li class="listitem"><code class="literal">gcp-path</code> sets the path of the GCP mount to use</li><li class="listitem"><code class="literal">jwt-validity</code> configures the JWT token validity. Defaults to 15 minutes.</li><li class="listitem"><code class="literal">project-id</code> allows overriding the project Id to a specific value. Defaults to the project Id from the obtained credential.</li><li class="listitem"><code class="literal">service-account</code> allows overriding the service account Id to a specific value. Defaults to the service account from the obtained credential.</li></ul></div><p>GCP IAM authentication requires the Google Cloud Java SDK dependency
|
||||
(<code class="literal">com.google.apis:google-api-services-iam</code> and <code class="literal">com.google.auth:google-auth-library-oauth2-http</code>)
|
||||
as the authentication implementation uses Google APIs for credentials and JWT signing.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Note"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Note]" src="images/note.png"></td><th align="left">Note</th></tr><tr><td align="left" valign="top"><p>Google credentials require an OAuth 2 token maintaining the token lifecycle. All API
|
||||
is synchronous therefore, <code class="literal">GcpIamAuthentication</code> does not support <code class="literal">AuthenticationSteps</code> which is
|
||||
required for reactive usage.</p></td></tr></table></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">Vault Documentation: Using the GCP auth backend</a></li><li class="listitem"><a class="link" href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt" target="_top">GCP Documentation: projects.serviceAccounts.signJwt</a><a name="vault.authentication.gcpiam" href="#vault.authentication.gcpiam"></a></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.kubernetes" href="#vault.config.authentication.kubernetes"></a>3.11 Kubernetes authentication</h2></div></div></div><p>Kubernetes authentication mechanism (since Vault 0.8.3) allows to authenticate with Vault using a Kubernetes Service Account Token.
|
||||
The authentication is role based and the role is bound to a service account name and a namespace.</p><p>A file containing a JWT token for a pod’s service account is automatically mounted at <code class="literal">/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p><div class="example"><a name="d0e1158" href="#d0e1158"></a><p class="title"><b>Example 3.22. bootstrap.yml with all Kubernetes authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: KUBERNETES
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> kubernetes</span>:
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> kubernetes-path</span>: kubernetes
|
||||
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account-token-file</span>: /var/run/secrets/kubernetes.io/serviceaccount/token</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the Role.</li><li class="listitem"><code class="literal">kubernetes-path</code> sets the path of the Kubernetes mount to use.</li><li class="listitem"><code class="literal">service-account-token-file</code> sets the location of the file containing the Kubernetes Service Account Token. Defaults to <code class="literal">/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</li></ul></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/kubernetes.html" target="_top">Vault Documentation: Kubernetes</a></li><li class="listitem"><a class="link" href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" target="_top">Kubernetes Documentation: Configure Service Accounts for Pods</a></li></ul></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="multi__client_side_usage.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="multi_vault.config.backends.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">2. Client Side Usage </td><td width="20%" align="center"><a accesskey="h" href="multi_spring-cloud-vault.html">Home</a></td><td width="40%" align="right" valign="top"> 4. Secret Backends</td></tr></table></div></body></html>
|
||||
Reference in New Issue
Block a user