Use token's username in policy path

user_2707419 0
Viewed 240

I have a Vault server where users will log-in using Userpass auth method and making use of kv secret engine. The structure is like below -

  -- user-kv
         -- u1
              -- u1-secret1
              -- u1-secret2
         -- u2
              -- u2-secret1
              -- u2-secret2
         -- u3
              -- u3-secret1

Here, u1, u2 , u3 are username of the users logged in using Userpass auth.

Now, for each user, I want to allow access to his path only. His path refers to this structure user-kv/<username>/ For example -

u1 --> user-kv/u1/*
u2 --> user-kv/u2/*
u3 --> user-kv/u3/* 
and so on....

I am currently doing this by creating a separate policy for each user and and assigning it to him. I believe this is not the right way as when number of users grow, it would be difficult to maintain.

Is there a way to specify the logged-in user's username in the path in a policy. Something like -

path user-kv/{{username}}/* {
     capabilities = ["read", "update", "create" ]
}

I have tried with templated policies but it doesn't work.

  • path user-kv/{{identity.entity.metadata.username}}/*
  • path user-kv/{{identity.entity.name}}/*

I can do something like user-kv/+/* but that would mean every user would have access to other's path.

Can anyone point out a more elegant way or provide links for further research?

hashicorp-vault
2 Answers

I don't have a Vault running at the moment to check this out, sorry, but I believe that the templated policy you tried should work. The key is to create an identity that is associated (via an alias) with the userpass user. It's been a while since I've done this, so I can't remember the details, but check out the docs: https://www.vaultproject.io/docs/secrets/identity

user_11983210

The basic idea you have is feasible, but it is a lot more complex than that.

First, some background

A user in Vault is called and entity. When you authenticate for the very first time, a Vault entity will be created automatically, unless one already exists.

Obviously, you had to login with some auth backend. Let's say you used LDAP. Whatever you actually used is irrelevant for this discussion.

When you authenticated, an entity alias was created to tie this specific user in that specific auth backend to an entity.

With that background information, here is where it gets complicated.

Vault supports multiple auth backends, and you can tie them all to a single entity. So if our user prefers to login with the Github auth backend, he still keeps his access rights (aka policies). That happens because you would have set the entity alias prior to the user logging in.

Now even if you are using a single auth backend, Vault will still behave like that, because it can't know what the future holds.

Now back to your question.

To allow a path to represent a user, you must use the syntax described here. But to use them, you need to know in advance either:

  1. The name of the entity
  2. The name of the user in the auth backend

Option #2 will also require you to assign multiple policies (one per auth backend). I suggest you go with option 1.

The easiest way to acheive what you want (even if it not that easy) is to provision entities before they log in, and associate metadata to it.

Say you add the metadata kv-user=u3 to the entity that represents the user named u3, Then use {{ identity.entity.metadata.kv-user }} in your policy file.

user_5910640
Related