Skip to main content
In this guide, you’ll learn how to leverage the HashiCorp Vault Identity Secrets Engine to:
  • Create a user with the userpass auth method
  • Define entities and entity aliases
  • Observe how combined policies affect access
  • (Optionally) Manage entities via the Vault UI
Before you begin, make sure a Vault server is running and you have a root token.
  • Vault ≥ 1.0 installed and unsealed
  • Root token for policy/entity management
  • vault CLI available in your $PATH

​
1. Review Existing Policies

List current policies to confirm what’s available:
Expected output:
We will use kv-policy and manager in this demo.

​
Policy Permissions Overview

​
2. Create a Userpass User

Define a new user bryan with the kv-policy attached:
You should see:
Verify the policy:
And inspect the manager policy:

​
3. Authenticate as bryan and Test Access

Log in with the new user:
Successful login shows:

​
Test Allowed Access

​
Test Denied Access

You should see a 403 Permission denied error because kv-policy does not cover operations/**.

​
4. Obtain the Userpass Mount Accessor

Re-authenticate as root and list auth methods to retrieve the mount_accessor:
Note the auth_userpass_0479382c value for the next step.

​
5. Create an Entity and Entity Alias

  1. Create an entity named “Bryan Krausen” with the manager policy:
  2. Link the user to that entity via an alias:

​
6. Verify Combined Policies

Log back in as bryan:
Now your token includes three policies:

​
Test Enhanced Access

  • Automation secret (via kv-policy):
  • Operations secret (via manager policy):
You can repeat this process to add additional aliases (e.g., GitHub, OIDC) to grant the same manager policy across auth methods.

​
7. Using the Vault UI

  1. In the Vault UI, navigate to Access → Entities.
  2. Create or delete entities, view details, and manage aliases.
The image shows a user interface for managing entities in a system, displaying details such as name, ID, and timestamps for creation and last update. It appears to be part of a software application related to access management.
  1. To add an alias, choose Create Entity Alias:
The image shows a web interface for creating an entity alias in HashiCorp Vault, with fields for "Name" and "Auth Backend" and options to create or cancel.
  1. Inspect token settings and policies:
The image shows a user interface for managing access in HashiCorp Vault, displaying token settings and policies for a user named "bryan." The sidebar includes options like Auth Methods, Entities, and Groups.
  1. View or merge entities as needed:
The image shows a web interface for managing entities in HashiCorp Vault, displaying a list of entities with their aliases and options to merge or create new entities.

Watch Video