Skip to main content
The Userpass authentication method enables Vault clients to log in using a username and password stored in Vault itself. Since it doesn’t depend on an external identity provider, Userpass is perfect for quick labs, testing environments, and simple use cases where you need basic credential management without added complexity.
Userpass does not enforce password complexity, expiration, or rotation by default. For production workloads, consider integrating Vault with external identity providers or LDAP.

​
How It Works

The image illustrates a "Userpass – Auth Workflow," showing a Vault user sending an authentication request with a username and password to a vault using the UserPass authentication method.
  1. User provides username (e.g., hcvop-engineer) and password.
  2. Vault validates credentials and issues a token.
  3. The token is used to interact with Vault’s API and secrets engines.

​
Configuration Workflow

The image illustrates a "Userpass – Configuration Workflow" showing the steps for a Vault Admin to create a user, provide credentials, and authenticate, with an optional password change for a developer.
  1. Vault Admin enables the userpass auth method.
  2. Admin creates a user with policies and token settings.
  3. Admin hands off credentials to the Developer.
  4. Developer logs in and obtains a token.
  5. Developer may update their password if allowed by policy.

​
Enabling Userpass

​
Creating a User

Run vault write against the auth/userpass/users/<username> path:
You can assign multiple policies (e.g., default,engineering-policy) or fine-tune token parameters per user.

​
Additional Token Configuration Options

Include these flags in the same vault write command when creating or updating a user.

​
Reading User Settings

Retrieve user configuration:
Sample output:

​
Modifying User Configuration

To update a single attribute, re-run vault write with the changed flag:
Only the specified setting (token_type) is updated; other attributes remain intact.

​
Authenticating with Userpass

Successful authentication returns:
  • Token
  • Duration (TTL)
  • Renewable flag
  • Attached policies
Your CLI automatically caches the token for subsequent commands.

​
Password Rotation

Grant users the ability to update their own password by adding this to their policy:
Then users can run:
This enables self-service rotation without exposing credentials to admins.

​
Best Practices and Considerations

  • Regularly revoke or delete user entries when access is no longer required.
  • Implement an external password policy (complexity, expiry) via automation or scripts.
  • For enterprise use, prefer OIDC, LDAP, or Kerberos auth methods to centralize identity management.

Watch Video