a3dfde5cec
* conversion stage 1 * correct image paths * add sidebar title to frontmatter * docs/concepts and docs/internals * configuration docs and multi-level nav corrections * commands docs, index file corrections, small item nav correction * secrets converted * auth * add enterprise and agent docs * add extra dividers * secret section, wip * correct sidebar nav title in front matter for apu section, start working on api items * auth and backend, a couple directory structure fixes * remove old docs * intro side nav converted * reset sidebar styles, add hashi-global-styles * basic styling for nav sidebar * folder collapse functionality * patch up border length on last list item * wip restructure for content component * taking middleman hacking to the extreme, but its working * small css fix * add new mega nav * fix a small mistake from the rebase * fix a content resolution issue with middleman * title a couple missing docs pages * update deps, remove temporary markup * community page * footer to layout, community page css adjustments * wip downloads page * deps updated, downloads page ready * fix community page * homepage progress * add components, adjust spacing * docs and api landing pages * a bunch of fixes, add docs and api landing pages * update deps, add deploy scripts * add readme note * update deploy command * overview page, index title * Update doc fields Note this still requires the link fields to be populated -- this is solely related to copy on the description fields * Update api_basic_categories.yml Updated API category descriptions. Like the document descriptions you'll still need to update the link headers to the proper target pages. * Add bottom hero, adjust CSS, responsive friendly * Add mega nav title * homepage adjustments, asset boosts * small fixes * docs page styling fixes * meganav title * some category link corrections * Update API categories page updated to reflect the second level headings for api categories * Update docs_detailed_categories.yml Updated to represent the existing docs structure * Update docs_detailed_categories.yml * docs page data fix, extra operator page remove * api data fix * fix makefile * update deps, add product subnav to docs and api landing pages * Rearrange non-hands-on guides to _docs_ Since there is no place for these on learn.hashicorp, we'll put them under _docs_. * WIP Redirects for guides to docs * content and component updates * font weight hotfix, redirects * fix guides and intro sidenavs * fix some redirects * small style tweaks * Redirects to learn and internally to docs * Remove redirect to `/vault` * Remove `.html` from destination on redirects * fix incorrect index redirect * final touchups * address feedback from michell for makefile and product downloads
132 lines
3.8 KiB
Markdown
132 lines
3.8 KiB
Markdown
---
|
|
layout: "docs"
|
|
page_title: "PingID MFA - MFA Support - Vault Enterprise"
|
|
sidebar_title: "PingID MFA"
|
|
sidebar_current: "docs-vault-enterprise-mfa-pingid"
|
|
description: |-
|
|
Vault Enterprise supports PingID MFA type.
|
|
---
|
|
|
|
# PingID MFA
|
|
|
|
This page demonstrates PingID MFA on ACL'd paths of Vault.
|
|
|
|
## Configuration
|
|
|
|
1. Enable the appropriate auth method:
|
|
|
|
```text
|
|
$ vault auth enable userpass
|
|
```
|
|
|
|
1. Fetch the mount accessor for the enabled auth method:
|
|
|
|
```text
|
|
$ vault auth list -detailed
|
|
```
|
|
|
|
The response will look like:
|
|
|
|
```text
|
|
Path Type Accessor Plugin Default TTL Max TTL Replication Description
|
|
---- ---- -------- ------ ----------- ------- ----------- -----------
|
|
token/ token auth_token_289703e9 n/a system system replicated token based credentials
|
|
userpass/ userpass auth_userpass_54b8e339 n/a system system replicated n/a
|
|
```
|
|
|
|
|
|
1. Configure PingID MFA:
|
|
|
|
```text
|
|
$ vault write sys/mfa/method/pingid/ping \
|
|
mount_accessor=auth_userpass_54b8e339 \
|
|
settings_file_base64="AABDwWaR..."
|
|
```
|
|
|
|
1. Create a policy that gives access to secret through the MFA method created
|
|
above:
|
|
|
|
```
|
|
$ vault policy write ping-policy -<<EOF
|
|
path "secret/foo" {
|
|
capabilities = ["read"]
|
|
mfa_methods = ["ping"]
|
|
}
|
|
EOF
|
|
```
|
|
|
|
1. Create a user. MFA works only for tokens that have identity information on
|
|
them. Tokens created by logging in using auth methods will have the associated
|
|
identity information. Create a user in the `userpass` auth method and
|
|
authenticate against it:
|
|
|
|
|
|
```text
|
|
$ vault write auth/userpass/users/testuser \
|
|
password=testpassword \
|
|
policies=ping-policy
|
|
```
|
|
|
|
1. Create a login token:
|
|
|
|
```text
|
|
$ vault write auth/userpass/login/testuser password=testpassword
|
|
|
|
Key Value
|
|
--- -----
|
|
token 70f97438-e174-c03c-40fe-6bcdc1028d6c
|
|
token_accessor a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
|
|
token_duration 768h0m0s
|
|
token_renewable true
|
|
token_policies [default ping-policy]
|
|
token_meta_username "testuser"
|
|
```
|
|
|
|
Note that the CLI is not authenticated with the newly created token yet, we
|
|
did not call `vault login`, instead we used the login API to simply return a
|
|
token.
|
|
|
|
1. Fetch the entity ID from the token. The caller identity is represented by the
|
|
`entity_id` property of the token:
|
|
|
|
```text
|
|
$ vault token lookup 70f97438-e174-c03c-40fe-6bcdc1028d6c
|
|
|
|
Key Value
|
|
--- -----
|
|
accessor a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
|
|
creation_time 1502245243
|
|
creation_ttl 2764800
|
|
display_name userpass-testuser
|
|
entity_id 307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
|
|
expire_time 2017-09-09T22:20:43.448543132-04:00
|
|
explicit_max_ttl 0
|
|
id 70f97438-e174-c03c-40fe-6bcdc1028d6c
|
|
issue_time 2017-08-08T22:20:43.448543003-04:00
|
|
meta map[username:testuser]
|
|
num_uses 0
|
|
orphan true
|
|
path auth/userpass/login/testuser
|
|
policies [default ping-policy]
|
|
renewable true
|
|
ttl 2764623
|
|
```
|
|
|
|
1. Login as the user:
|
|
|
|
```text
|
|
$ vault login 70f97438-e174-c03c-40fe-6bcdc1028d6c
|
|
```
|
|
|
|
1. Read a secret to trigger a PingID push. This will be a blocking call until
|
|
the push notification is either approved or declined:
|
|
|
|
```text
|
|
$ vault read secret/foo
|
|
|
|
Key Value
|
|
--- -----
|
|
refresh_interval 768h
|
|
data which can only be read after MFA validation
|
|
```
|