HashiCorp Certified: Vault Associate Certification
Compare Authentication Methods
Working with Auth Methods
In this guide, we explore how to enable, configure, and consume Vault’s authentication methods. By default, Vault initializes with only the Token auth method. To integrate additional backends—such as cloud provider, AppRole, LDAP, or Kubernetes—you must explicitly enable and configure each one. Vault supports multiple auth methods simultaneously, allowing you to tailor access for different workloads, from human users to automated services.
Common scenarios include:
- Cloud-native applications leveraging provider-specific auth methods to eliminate embedded credentials.
- Legacy applications using static credentials or external identity providers for compatibility.
Default Token Authentication
Vault’s Token auth method is enabled by default and cannot be disabled or remounted under a different path. During initialization, Vault generates an initial root token:
vault operator init
Use this root token to:
- Log in for the first time.
- Enable additional auth backends (e.g., LDAP, AWS, AppRole).
- Configure policies and roles.
- Rotate, revoke, or secure the root token once setup is complete.
Warning
Keep your initial root token secure. Rotate or revoke it after adding other auth methods to follow security best practices.
Enabling and Configuring Auth Backends
Auth methods can be managed via the CLI, the HTTP API, or the UI. While the UI is improving, full feature coverage is available through the CLI and API.
To enable the AppRole auth method with the CLI:
vault auth enable approle
Example output:
Success! Enabled approle auth method at: approle/
Note
Auth methods are mounted at a specific path—by default, the path matches the method name. To use a custom path, first disable the method, then re-enable it with the -path flag.
Custom Mount Path Example
vault auth disable approle
vault auth enable -path=custom-approle approle
Example output:
Success! Enabled approle auth method at: custom-approle/
If you omit -path, Vault mounts the method at aws/, ldap/, etc., based on the method name.
Common Auth Methods and CLI Commands
Use this quick reference to enable frequently used Vault auth methods:
| Auth Method | Use Case | CLI Command |
|---|---|---|
| Token | Default method for users and root | vault login |
| AppRole | Machine-to-machine authentication | vault auth enable approle |
| AWS | IAM-based cloud-native access | vault auth enable aws |
| LDAP | Enterprise user directory | vault auth enable ldap |
| Kubernetes | Pod service account integration | vault auth enable kubernetes |
Next Steps
After mounting an auth method, configure its roles, policies, and settings according to your use case. For detailed instructions per backend, see the official documentation:
Links and References
Watch Video
Watch video content