184 lines
15 KiB
Plaintext
184 lines
15 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Sentinel Properties
|
|
description: An overview of how Sentinel interacts with Vault Enterprise.
|
|
---
|
|
|
|
# Properties
|
|
|
|
Vault injects a rich set of data into the running Sentinel environment,
|
|
allowing for very fine-grained controls. The set of available properties are
|
|
enumerated on this page.
|
|
|
|
The following properties are available for use in Sentinel policies.
|
|
|
|
## Namespace Properties
|
|
|
|
The `namespace` (Sentinel) namespace gives access to information about the
|
|
namespace in which the request is running. (This may or may not match the
|
|
client's chosen namespace, if a request reaches into a child namespace).
|
|
|
|
| Name | Type | Description |
|
|
| :----- | :------- | :----------------------------- |
|
|
| `id` | `string` | The namespace ID |
|
|
| `path` | `string` | The root path of the namespace |
|
|
|
|
## Request Properties
|
|
|
|
The following properties are available in the `request` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :----------------------- | :-------------------- | :------------------------------------------------------------------------------------------ |
|
|
| `connection.remote_addr` | `string` | TCP/IP source address of the client |
|
|
| `data` | `map (string -> any)` | Raw request data |
|
|
| `operation` | `string` | Operation type, e.g. "read" or "update" |
|
|
| `path` | `string` | Path, with any leading `/` trimmed |
|
|
| `policy_override` | `bool` | `true` if a `soft-mandatory` policy override was requested |
|
|
| `unauthenticated` | `bool` | `true` if the requested path is an unauthenticated path |
|
|
| `wrapping.ttl` | `duration` | The requested response-wrapping TTL in nanoseconds, suitable for use with the `time` import |
|
|
| `wrapping.ttl_seconds` | `int` | The requested response-wrapping TTL in seconds |
|
|
|
|
### Replication Properties
|
|
|
|
The following properties exists at the `replication.mode` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :------------ | :------- | :------------------------------------------------------------------------------------------------------------- |
|
|
| `dr` | `string` | The state of DR replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary" |
|
|
| `replication` | `string` | The state of performance replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary" |
|
|
|
|
## Token Properties
|
|
|
|
The following properties, if available, are in the `token` namespace. The
|
|
namespace will not exist if there is no token information attached to a
|
|
request, e.g. when logging in.
|
|
|
|
| Name | Type | Description |
|
|
| :------------------------- | :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `creation_time` | `string` | The timestamp of the token's creation, in RFC3339 format |
|
|
| `creation_time_unix` | `int` | The timestamp of the token's creation, in seconds since Unix epoch UTC |
|
|
| `creation_ttl` | `duration` | The TTL the token was first created with in nanoseconds, suitable for use with the `time` import |
|
|
| `creation_ttl_seconds` | `int` | The TTL the token was first created with in seconds |
|
|
| `display_name` | `string` | The display name set on the token, if any |
|
|
| `entity_id` | `string` | The Identity entity ID attached to the token, if any |
|
|
| `explicit_max_ttl` | `duration` | If the token has an explicit max TTL, the duration of the explicit max TTL in nanoseconds, suitable for use with the `time` import |
|
|
| `explicit_max_ttl_seconds` | `int` | If the token has an explicit max TTL, the duration of the explicit max TTL in seconds |
|
|
| `metadata` | `map (string -> string)` | Metadata set on the token |
|
|
| `num_uses` | `int` | The number of uses remaining on a use-count-limited token; 0 if the token has no use-count limit |
|
|
| `path` | `string` | The request path that resulted in creation of this token |
|
|
| `period` | `duration` | If the token has a period, the duration of the period in nanoseconds, suitable for use with the `time` import |
|
|
| `period_seconds` | `int` | If the token has a period, the duration of the period in seconds |
|
|
| `policies` | `list (string)` | Policies directly attached to the token |
|
|
| `role` | `string` | If created via a token role, the role that created the token |
|
|
| `type` | `string` | The type of token, currently will be either `batch` or `service` |
|
|
|
|
## Token Namespace Properties
|
|
|
|
The following properties, if available, are in the `token.namespace` namespace.
|
|
The (Sentinel) namespace will not exist if there is no token information attached to a
|
|
request, e.g. when logging in.
|
|
|
|
| Name | Type | Description |
|
|
| :----- | :------- | :----------------------------- |
|
|
| `id` | `string` | The namespace ID |
|
|
| `path` | `string` | The root path of the namespace |
|
|
|
|
## Identity Properties
|
|
|
|
The following properties, if available, are in the `identity` namespace. The
|
|
namespace may not exist if there is no token information attached to the
|
|
request; however, at login time the user's request data will be used to attempt
|
|
to find any existing Identity information, or create some information to pass
|
|
to MFA functions.
|
|
|
|
### Entity Properties
|
|
|
|
These exist at the `identity.entity` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :------------------ | :----------------------- | :------------------------------------------------------------ |
|
|
| `creation_time` | `string` | The entity's creation time in RFC3339 format |
|
|
| `id` | `string` | The entity's ID |
|
|
| `last_update_time` | `string` | The entity's last update (modify) time in RFC3339 format |
|
|
| `metadata` | `map (string -> string)` | Metadata associated with the entity |
|
|
| `name` | `string` | The entity's name |
|
|
| `merged_entity_ids` | `list (string)` | A list of IDs of entities that have been merged into this one |
|
|
| `aliases` | `list (alias)` | List of aliases associated with this entity |
|
|
| `policies` | `list (string)` | List of the policies set on this entity |
|
|
|
|
### Alias Properties
|
|
|
|
These can be retrieved from `identity.entity.aliases`.
|
|
|
|
| Name | Type | Description |
|
|
| :----------------------- | :----------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `creation_time` | `string` | The alias's creation time in RFC3339 format |
|
|
| `id` | `string` | The alias's ID |
|
|
| `last_update_time` | `string` | The alias's last update (modify) time in RFC3339 format |
|
|
| `metadata` | `map (string -> string)` | Metadata associated with the alias
|
|
| `custom_metadata` | `map (string -> string)` | Custom metadata associated with the alias |
|
|
| `merged_from_entity_ids` | `list (string)` | If this alias was attached to the current entity via one or more merges, the original entity/entities will be in this list |
|
|
| `mount_accessor` | `string` | The immutable accessor of the mount that created this alias |
|
|
| `mount_path` | `string` | The path of the mount that created this alias; unlike the accessor, there is no guarantee that the current path represents the original mount |
|
|
| `mount_type` | `string` | The type of the mount that created this alias |
|
|
| `name` | `string` | The alias's name |
|
|
|
|
### Groups Properties
|
|
|
|
These exist at the `identity.groups` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :-------- | :---------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `by_id` | `map (string -> group)` | A map of group ID to group information |
|
|
| `by_name` | `map (string -> group)` | A map of group name to group information; unlike the group ID, there is no guarantee that the current name will always represent the same group |
|
|
|
|
### Group Properties
|
|
|
|
These can be retrieved from the `identity.groups` maps.
|
|
|
|
| Name | Type | Description |
|
|
| :------------------ | :----------------------- | :----------------------------------------------------------------- |
|
|
| `creation_time` | `string` | The group's creation time in RFC3339 format |
|
|
| `id` | `string` | The group's ID |
|
|
| `last_update_time` | `string` | The group's last update (modify) time in RFC3339 format |
|
|
| `metadata` | `map (string -> string)` | Metadata associated with the group |
|
|
| `name` | `string` | The group's name |
|
|
| `member_entity_ids` | `list (string)` | A list of IDs of entities that are directly assigned to this group |
|
|
| `parent_group_ids` | `list (string)` | A list of IDs of groups that are parents of this group |
|
|
| `policies` | `list (string)` | List of the policies set on this group |
|
|
|
|
## MFA Properties
|
|
|
|
These properties exist at the `mfa` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :-------- | :----------------------- | :---------------------------------------- |
|
|
| `methods` | `map (string -> method)` | A map of method name to method properties |
|
|
|
|
### MFA Method Properties
|
|
|
|
These properties can be accessed via the `mfa.methods` selector.
|
|
|
|
| Name | Type | Description |
|
|
| :------ | :----- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `valid` | `bool` | Whether the method has successfully been validated; if validation has not been attempted, this will trigger the validation attempt. The result of the validation attempt will be used for this method for all policies for the given request. |
|
|
|
|
## Control Group Properties
|
|
|
|
These properties exist at the `controlgroup` namespace.
|
|
|
|
| Name | Type | Description |
|
|
| :--------------------- | :--------------------- | :------------------------------------------ |
|
|
| `time`, `request_time` | `string` | The original request time in RFC3339 format |
|
|
| `authorizations` | `list (authorization)` | List of control group authorizations |
|
|
|
|
### Control Group Authorization
|
|
|
|
These properties can be accessed via the `controlgroup.authorizations` selector.
|
|
|
|
| Name | Type | Description |
|
|
| :------- | :---------------- | :--------------------------------------------------------- |
|
|
| `time` | `string` | The authorization time in RFC3339 format |
|
|
| `entity` | `identity.entity` | The identity entity for the authorizer. |
|
|
| `groups` | `identity.groups` | The map of identity groups associated with the authorizer. |
|