What authentication methods does Vault support?

Vault supports many auth methods including Token (default), Userpass, LDAP/Active Directory, AppRole (for machines/CI-CD), Certificate (TLS), OIDC, AWS IAM, Kubernetes, GitHub, and more. Each method issues a Vault token upon successful authentication.

How do I enable an auth method in Vault?

Enable an auth method with 'vault auth enable '. For example: 'vault auth enable userpass' or 'vault auth enable -path=company-ldap ldap'. The -path flag allows custom mount points for multiple instances.

How do I configure LDAP authentication?

Configure LDAP with 'vault write auth/ldap/config url=ldap://server:389 userdn=ou=users,dc=example,dc=com groupdn=ou=groups,dc=example,dc=com'. Then map groups to policies with 'vault write auth/ldap/groups/admins policies=admin-policy'.

What is AppRole and when should I use it?

AppRole is an authentication method designed for machines and automated workflows like CI/CD pipelines. It uses a role_id (like a username) and secret_id (like a password) to authenticate. Use it for Jenkins, GitHub Actions, or any automated system needing Vault access.

How do I set up userpass authentication?

Enable userpass with 'vault auth enable userpass', then create users with 'vault write auth/userpass/users/username password=secret policies=user-policy'. Users authenticate with 'vault login -method=userpass username=username'.

How do I authenticate with a certificate?

Enable cert auth with 'vault auth enable cert', register certificates with 'vault write auth/cert/certs/name certificate=@cert.pem policies=cert-policy', then authenticate with 'vault login -method=cert -client-cert=cert.pem -client-key=key.pem'.

How do I list enabled auth methods?

List all enabled auth methods with 'vault auth list'. This shows the path, type, accessor, and description of each enabled authentication method in your Vault instance.

What's the difference between auth methods and tokens?

Auth methods are ways to prove identity to Vault (LDAP credentials, certificates, etc.). Upon successful authentication, Vault issues a token. The token is then used for all subsequent API requests. All auth methods ultimately produce tokens.

How do I disable an auth method?

Disable an auth method with 'vault auth disable '. For example: 'vault auth disable userpass/'. Warning: This revokes all tokens issued by that auth method and deletes all configuration.

Can I use multiple auth methods simultaneously?

Yes, you can enable multiple auth methods at different paths. For example, use LDAP for human users, AppRole for CI/CD, and Kubernetes auth for container workloads. Each can have different policies attached.

HashiCorp Vault Authentication Methods: Complete Configuration Guide

Authentication is the first line of defense in HashiCorp Vault. Before any client can read secrets or perform operations, they must prove their identity through an authentication method. This guide covers configuring the most common auth methods for enterprise environments.

Understanding Vault Authentication

Every auth method in Vault follows the same pattern:

Client provides credentials (password, certificate, IAM role, etc.)
Vault validates the credentials against the configured backend
Upon success, Vault issues a token with attached policies
The client uses this token for all subsequent requests

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│   Client        │────▶│   Auth Method   │────▶│   Vault Token   │
│   (Credentials) │     │   (Validation)  │     │   (Policies)    │
└─────────────────┘     └─────────────────┘     └─────────────────┘

Managing Auth Methods

Listing Auth Methods

# List all enabled auth methods
vault auth list

# Detailed output
vault auth list -detailed

Enabling Auth Methods

# Enable at default path
vault auth enable userpass

# Enable at custom path
vault auth enable -path=company-ldap ldap

# Enable with description
vault auth enable -description="Production LDAP" ldap

Disabling Auth Methods

# Disable auth method (revokes all tokens!)
vault auth disable userpass/

Warning: Disabling an auth method immediately revokes all tokens issued by that method.

LDAP Authentication

LDAP authentication integrates Vault with Active Directory or other LDAP directories, enabling centralized user management.

Configure LDAP Connection

vault write auth/ldap/config \
  url="ldap://dc.example.com:389" \
  userattr="sAMAccountName" \
  userdn="ou=Users,dc=example,dc=com" \
  groupdn="ou=Groups,dc=example,dc=com" \
  groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))" \
  groupattr="cn" \
  upndomain="example.com" \
  insecure_tls=false \
  starttls=true

Key Configuration Options

Parameter	Description
`url`	LDAP server URL (ldap:// or ldaps://)
`userattr`	Attribute for username matching (sAMAccountName for AD)
`userdn`	Base DN to search for users
`groupdn`	Base DN to search for groups
`groupfilter`	LDAP filter for group membership
`binddn`	DN for bind operations (service account)
`bindpass`	Password for bind DN
`starttls`	Enable STARTTLS encryption

Map LDAP Groups to Policies

# Map AD group to Vault policy
vault write auth/ldap/groups/vault-admins policies=admin-policy

# Map multiple policies
vault write auth/ldap/groups/developers policies=dev-policy,readonly-policy

# Map specific user (overrides group policies)
vault write auth/ldap/users/john.doe policies=special-policy

Authenticate with LDAP

# Interactive login
vault login -method=ldap username=john.doe

# Non-interactive (password in environment)
vault login -method=ldap username=john.doe password="$LDAP_PASSWORD"

Userpass Authentication

Userpass provides simple username/password authentication managed directly in Vault.

Enable and Configure

# Enable userpass auth
vault auth enable userpass

Managing Users

# Create user with password and policies
vault write auth/userpass/users/alice \
  password="securepassword123" \
  policies="developer,readonly"

# Update user's password
vault write auth/userpass/users/alice \
  password="newpassword456"

# Update policies only
vault write auth/userpass/users/alice \
  policies="developer,admin"

# Delete user
vault delete auth/userpass/users/alice

# List all users
vault list auth/userpass/users

Secure Password Creation

Generate and store passwords securely:

# Generate random password
PASS=$(openssl rand -base64 24)

# Create user (password not in command history)
vault write auth/userpass/users/bob password="$PASS" policies=default

# Store password temporarily using response wrapping
vault read -wrap-ttl=5m -field=password <(echo "password=$PASS")
unset PASS

Authenticate with Userpass

# Interactive (prompts for password)
vault login -method=userpass username=alice

# Non-interactive
vault login -method=userpass username=alice password="$PASSWORD"

AppRole Authentication

AppRole is designed for machine-to-machine authentication, particularly CI/CD pipelines and automated systems.

Enable AppRole

vault auth enable approle

Create an AppRole

# Create role with policies
vault write auth/approle/role/jenkins-role \
  token_policies="ci-policy" \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=10m \
  secret_id_num_uses=1

Key AppRole Parameters

Parameter	Description
`token_policies`	Policies attached to generated tokens
`token_ttl`	Token time-to-live
`token_max_ttl`	Maximum token lifetime
`secret_id_ttl`	How long secret_id is valid
`secret_id_num_uses`	Number of times secret_id can be used
`bind_secret_id`	Require secret_id for login (default: true)
`secret_id_bound_cidrs`	Restrict secret_id usage to IP ranges

Retrieve Credentials

# Get role_id (can be embedded in application)
vault read auth/approle/role/jenkins-role/role-id

# Generate secret_id (should be delivered securely)
vault write -f auth/approle/role/jenkins-role/secret-id

Authenticate with AppRole

# Login with role_id and secret_id
vault write auth/approle/login \
  role_id="$ROLE_ID" \
  secret_id="$SECRET_ID"

CI/CD Integration Example

#!/bin/bash
# Jenkins pipeline script

# Retrieve token using AppRole
VAULT_TOKEN=$(vault write -format=json auth/approle/login \
  role_id="$ROLE_ID" \
  secret_id="$SECRET_ID" | jq -r '.auth.client_token')

export VAULT_TOKEN

# Now use Vault to get secrets
DB_PASSWORD=$(vault kv get -field=password secret/database)

For a complete CI/CD integration guide, see AppRole Authentication for CI/CD.

Certificate Authentication

Certificate (TLS) authentication uses X.509 certificates for identity verification, ideal for automated systems with PKI infrastructure.

Enable Certificate Auth

vault auth enable cert

Create Authentication Certificate

# Generate private key
openssl genrsa -out client.key 2048

# Create certificate signing request
openssl req -new -key client.key -out client.csr \
  -subj "/CN=jenkins-server/O=DevOps"

# Sign with your CA (or self-sign for testing)
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out client.crt -days 365

Register Certificate in Vault

vault write auth/cert/certs/jenkins \
  display_name="Jenkins CI Server" \
  policies="ci-policy" \
  certificate=@client.crt \
  ttl=3600

Authenticate with Certificate

vault login -method=cert \
  -client-cert=client.crt \
  -client-key=client.key

Certificate Auth with CURL

curl --cert client.crt --key client.key \
  -X POST $VAULT_ADDR/v1/auth/cert/login

Note: macOS's built-in curl may have issues with client certificates. Use Homebrew's curl or the Vault CLI instead.

Token Authentication

Token auth is always enabled and is the foundation of Vault authentication. All other auth methods issue tokens.

# Login with existing token
vault login <token>

# Interactive prompt
vault login

Token Lookup

# Check current token
vault token lookup

# Check specific token
vault token lookup <token>

For comprehensive token management including creation, renewal, and revocation, see our Token Management Guide.

GitHub Authentication

GitHub auth allows users to authenticate with their GitHub personal access tokens.

Enable and Configure

# Enable GitHub auth
vault auth enable github

# Configure organization
vault write auth/github/config organization=my-company

Map Teams to Policies

# Map GitHub team to Vault policy
vault write auth/github/map/teams/platform policies=platform-policy

# Map specific user
vault write auth/github/map/users/octocat policies=admin-policy

Authenticate

vault login -method=github token="$GITHUB_TOKEN"

Kubernetes Authentication

Kubernetes auth allows pods to authenticate using their service account tokens.

Enable and Configure

# Enable Kubernetes auth
vault auth enable kubernetes

# Configure with cluster details
vault write auth/kubernetes/config \
  kubernetes_host="https://kubernetes.default.svc" \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

Create Role for Service Account

vault write auth/kubernetes/role/webapp \
  bound_service_account_names=webapp \
  bound_service_account_namespaces=production \
  policies=webapp-policy \
  ttl=1h

Authenticate from Pod

JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
vault write auth/kubernetes/login role=webapp jwt=$JWT

Best Practices

1. Use Appropriate Auth Methods

Use Case	Recommended Auth Method
Human users	LDAP, OIDC, Userpass
CI/CD pipelines	AppRole
Kubernetes pods	Kubernetes auth
AWS workloads	AWS IAM auth
Automated scripts	AppRole or Certificate

2. Apply Least Privilege

# Create minimal policies
vault policy write ci-readonly - <<EOF
path "secret/data/ci/*" {
  capabilities = ["read"]
}
EOF

# Attach to auth method
vault write auth/approle/role/ci-reader token_policies="ci-readonly"

3. Set Appropriate TTLs

# Short TTLs for automated systems
vault write auth/approle/role/short-lived \
  token_ttl=5m \
  token_max_ttl=30m

# Longer TTLs for interactive users
vault write auth/ldap/config \
  token_ttl=8h \
  token_max_ttl=24h

4. Enable Audit Logging

# Enable file audit
vault audit enable file file_path=/var/log/vault/audit.log

# All auth attempts are logged

5. Use Multiple Auth Methods

Deploy different auth methods for different use cases:

# Human users via LDAP
vault auth enable -path=ldap-users ldap

# CI/CD via AppRole
vault auth enable -path=cicd approle

# Kubernetes workloads
vault auth enable -path=k8s kubernetes

Troubleshooting

LDAP Connection Failed

Error: ldap operation failed: Cannot connect to LDAP server

Solutions:

Verify LDAP URL and port
Check network connectivity
Ensure starttls=true if required
Verify bind credentials

Invalid Credentials

Error: invalid username or password

Solutions:

Check username format (with/without domain)
Verify password
Check userattr configuration matches your directory

Token Has No Policies

Cause: Auth method not configured with policies

Solution:

# Check role/user policies
vault read auth/ldap/groups/developers
vault read auth/approle/role/jenkins-role

Command Reference

Command	Description
`vault auth list`	List enabled auth methods
`vault auth enable <method>`	Enable auth method
`vault auth disable <path>`	Disable auth method
`vault login -method=<method>`	Authenticate
`vault write auth/<path>/config`	Configure auth method

Next Steps

Configure Vault Policies to control access
Set up AppRole for CI/CD pipelines
Learn Token Management for secure access

For more Vault security guides, explore our complete HashiCorp Vault series.

HashiCorp Vault Authentication Methods: Complete Configuration Guide

Frequently Asked Questions

Related articles

Vault AppRole Authentication: Complete CI/CD Integration Guide

HashiCorp Vault Token Management: Complete Authentication

HashiCorp Vault Policies: Complete ACL and Authorization Guide