> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Userpass Auth Method > This tutorial covers enabling and managing the userpass auth method in Vault, including user creation and authentication. In this tutorial, you’ll learn how to enable and manage the `userpass` auth method in Vault. We’ll cover: * Enabling and inspecting auth backends * Configuring and listing policies * Creating, reading, and updating users * Authenticating with the `userpass` method ## Table of Contents 1. [Enable the userpass Auth Method](#enable-the-userpass-auth-method) 2. [Inspect Auth Backends](#inspect-auth-backends) 3. [Manage Policies](#manage-policies) 4. [Create and Configure Users](#create-and-configure-users) 5. [Authenticate with userpass](#authenticate-with-userpass) *** ## 1. Enable the userpass Auth Method First, see which auth methods are currently enabled: ```bash theme={null} vault auth list ``` Example output: | Path | Type | Accessor | Description | | ------ | ----- | --------------------- | ----------------------- | | token/ | token | auth\_token\_9e81d3bb | token based credentials | Enable `userpass` at the default path: ```bash theme={null} vault auth enable userpass ``` Success message: ```text theme={null} Success! Enabled userpass auth method at: userpass/ ``` :::note Custom Path You can also enable `userpass` under a custom mount point, for example `local`: ```bash theme={null} vault auth enable -path=local userpass ``` ::: After enabling, verify both default and custom mounts: ```bash theme={null} vault auth list ``` | Path | Type | Accessor | Description | | --------- | -------- | ----------------------- | ----------------------- | | local/ | userpass | auth\_userpass\_abcd123 | n/a | | userpass/ | userpass | auth\_userpass\_efgh456 | n/a | | token/ | token | auth\_token\_9e81d3bb | token based credentials | If you only need the default mount, disable the custom one: ```bash theme={null} vault auth disable local ``` Now you should see: ```bash theme={null} vault auth list ``` | Path | Type | Accessor | Description | | --------- | -------- | ----------------------- | ----------------------- | | token/ | token | auth\_token\_9e81d3bb | token based credentials | | userpass/ | userpass | auth\_userpass\_efgh456 | n/a | *** ## 2. Inspect Auth Backends Vault supports multiple auth methods. To view all enabled backends: ```bash theme={null} vault auth list ``` | Mount Point | Auth Method | Description | | ----------- | ----------- | -------------------------- | | token/ | token | Token-based authentication | | userpass/ | userpass | Username & password | For more details, see the [Vault Authentication Methods](https://www.vaultproject.io/docs/auth) reference. *** ## 3. Manage Policies Before creating users, check existing policies: ```bash theme={null} vault policy list ``` Example output: * default * kv-policy * root We’ll use `kv-policy` in this demo to grant Key/Value access. *** ## 4. Create and Configure Users ### 4.1 Create Users Add a new user named `automation` with `kv-policy`: ```bash theme={null} vault write auth/userpass/users/automation \ password=Password1 \ policies=kv-policy ``` Success message: ```text theme={null} Success! Data written to: auth/userpass/users/automation ``` Verify the list of `userpass` users: ```bash theme={null} vault list auth/userpass/users ``` | Keys | | ---------- | | automation | Add a second user `bryan`: ```bash theme={null} vault write auth/userpass/users/bryan \ password=Secret123 \ policies=kv-policy ``` Confirm both users: ```bash theme={null} vault list auth/userpass/users ``` | Keys | | ---------- | | automation | | bryan | ### 4.2 Read and Update User Configuration #### Read Current Settings Inspect the `automation` user: ```bash theme={null} vault read auth/userpass/users/automation ``` | Key | Value | | -------------------------- | ------------ | | policies | \[kv-policy] | | token\_ttl | 0s | | token\_max\_ttl | 0s | | token\_no\_default\_policy | false | By default, TTLs are `0s`, inheriting the system defaults. #### Update Token TTL Set a 24-hour token TTL for `automation`: ```bash theme={null} vault write auth/userpass/users/automation token_ttl=24h ``` Verify the update: ```bash theme={null} vault read auth/userpass/users/automation ``` | Key | Value | | ---------- | ------------ | | token\_ttl | 24h | | policies | \[kv-policy] | :::note Token Time-To-Live (TTL) Defining `token_ttl` limits how long a login token remains valid. Adjust according to your security requirements. ::: *** ## 5. Authenticate with userpass Now that your user is configured, log in with: ```bash theme={null} vault login -method=userpass username=automation ``` Enter the password when prompted. Example response: ```text theme={null} Success! You are now authenticated. Key Value --- ----- token hvs.CAE...5sNTd token_accessor 62meW...3mjErMQwlQ token_duration 24h token_renewable true token_policies ["default" "kv-policy"] token_meta_username automation ``` You now have a token scoped to `kv-policy` with a 24-hour TTL. To reuse the token directly: ```bash theme={null} vault login hvs.CAE...5sNTd ``` Success message: ```text theme={null} Success! Token renewed successfully. ``` :::warning Security Reminder Always store your Vault tokens securely. Avoid checking plaintext tokens into version control or logs. ::: *** ## Conclusion You’ve successfully: * Enabled and inspected the `userpass` auth method * Listed and managed Vault policies * Created users and customized their token TTL * Authenticated via `userpass` for secure, password-based access For more on Vault auth methods and best practices, visit the [HashiCorp Vault Documentation](https://www.vaultproject.io/docs/).