From f596d2c55c0b0914f427d01f32ab4967d1f47822 Mon Sep 17 00:00:00 2001
From: Mark Paluch <mpaluch@vmware.com>
Date: Tue, 16 Mar 2021 14:53:20 +0100
Subject: [PATCH] Document paths and operations for SecretLeaseContainer and
 Session management for ACL setup.

Closes gh-561
---
 docs/src/main/asciidoc/authentication.adoc | 55 ++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/docs/src/main/asciidoc/authentication.adoc b/docs/src/main/asciidoc/authentication.adoc
index e33bd481..f27d173b 100644
--- a/docs/src/main/asciidoc/authentication.adoc
+++ b/docs/src/main/asciidoc/authentication.adoc
@@ -656,3 +656,58 @@ Defaults to `${CF_INSTANCE_KEY}` env variable.
 NOTE: PCF authentication requires BouncyCastle (bcpkix-jdk15on) to be on the classpath for RSA PSS signing.
 
 See also: https://www.vaultproject.io/docs/auth/pcf.html[Vault Documentation: Using the pcf auth backend]
+
+[[vault.config.acl]]
+== ACL Requirements
+
+This section explains which paths are accessed by Spring Vault so you can derive your policy declarations from the required capabilities.
+
+|===
+|Capability |Associated HTTP verbs
+
+|create
+|`POST`/`PUT`
+
+|read
+|`GET`
+
+|update
+|`POST`/`PUT`
+
+|delete
+|`DELETE`
+
+|list
+|`LIST` (`GET`)
+|===
+
+
+See also https://www.vaultproject.io/guides/identity/policies.
+
+=== Authentication
+
+Login: `POST auth/$authMethod/login`
+
+=== KeyValue Mount Discovery
+
+`GET sys/internal/ui/mounts/$mountPath`
+
+=== SecretLeaseContainer
+
+`SecretLeaseContainer` uses different paths depending on the configured lease endpoint.
+
+`LeaseEndpoints.Legacy`
+
+* Revocation: `PUT sys/revoke`
+* Renewal: `PUT sys/renew`
+
+`LeaseEndpoints.Leases` (`SysLeases`)
+
+* Revocation: `PUT sys/leases/revoke`
+* Renewal: `PUT sys/leases/renew`
+
+=== Session Management
+
+* Token lookup: `GET auth/token/lookup-self`
+* Renewal: `POST auth/token/renew-self`
+* Revoke: `POST auth/token/revoke-self`