15 KiB
| layout | page_title | sidebar_title | sidebar_current | description |
|---|---|---|---|---|
| docs | Sentinel Properties | Properties | docs-vault-enterprise-sentinel-properties | An overview of how Sentinel interacts with Vault Enterprise. |
Properties
Vault injects a rich set of data into the running Sentinel environment, allowing for very fine-grained controls. The set of available properties are enumerated on this page.
The following properties are available for use in Sentinel policies.
Namespace Properties
The namespace (Sentinel) namespace gives access to information about the
namespace in which the request is running. (This may or may not match the
client's chosen namespace, if a request reaches into a child namespace).
| Name | Type | Description |
|---|---|---|
id |
string |
The namespace ID |
path |
string |
The root path of the namespace |
Request Properties
The following properties are available in the request namespace.
| Name | Type | Description |
|---|---|---|
connection.remote_addr |
string |
TCP/IP source address/port of the client |
data |
map (string -> any) |
Raw request data |
operation |
string |
Operation type, e.g. "read" or "update" |
path |
string |
Path, with any leading / trimmed |
policy_override |
bool |
true if a soft-mandatory policy override was requested |
unauthenticated |
bool |
true if the requested path is an unauthenticated path |
wrapping.ttl |
duration |
The requested response-wrapping TTL in nanoseconds, suitable for use with the time import |
wrapping.ttl_seconds |
int |
The requested response-wrapping TTL in seconds |
Replication Properties
The following properties exists at the replication.mode namespace.
| Name | Type | Description |
|---|---|---|
dr |
string |
The state of DR replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary" |
replication |
string |
The state of performance replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary" |
Token Properties
The following properties, if available, are in the token namespace. The
namespace will not exist if there is no token information attached to a
request, e.g. when logging in.
| Name | Type | Description |
|---|---|---|
creation_time |
string |
The timestamp of the token's creation, in RFC3339 format |
creation_time_unix |
int |
The timestamp of the token's creation, in seconds since Unix epoch UTC |
creation_ttl |
duration |
The TTL the token was first created with in nanoseconds, suitable for use with the time import |
creation_ttl_seconds |
int |
The TTL the token was first created with in seconds |
display_name |
string |
The display name set on the token, if any |
entity_id |
string |
The Identity entity ID attached to the token, if any |
explicit_max_ttl |
duration |
If the token has an explicit max TTL, the duration of the explicit max TTL in nanoseconds, suitable for use with the time import |
explicit_max_ttl_seconds |
int |
If the token has an explicit max TTL, the duration of the explicit max TTL in seconds |
metadata |
map (string -> string) |
Metadata set on the token |
num_uses |
int |
The number of uses remaining on a use-count-limited token; 0 if the token has no use-count limit |
path |
string |
The request path that resulted in creation of this token |
period |
duration |
If the token has a period, the duration of the period in nanoseconds, suitable for use with the time import |
period_seconds |
int |
If the token has a period, the duration of the period in seconds |
policies |
list (string) |
Policies directly attached to the token |
role |
string |
If created via a token role, the role that created the token |
type |
string |
The type of token, currently will be either batch or service |
Identity Properties
The following properties, if available, are in the identity namespace. The
namespace may not exist if there is no token information attached to the
request; however, at login time the user's request data will be used to attempt
to find any existing Identity information, or create some information to pass
to MFA functions.
Entity Properties
These exist at the identity.entity namespace.
| Name | Type | Description |
|---|---|---|
creation_time |
string |
The entity's creation time in RFC3339 format |
id |
string |
The entity's ID |
last_update_time |
string |
The entity's last update (modify) time in RFC3339 format |
metadata |
map (string -> string) |
Metadata associated with the entity |
name |
string |
The entity's name |
merged_entity_ids |
list (string) |
A list of IDs of entities that have been merged into this one |
aliases |
list (alias) |
List of aliases associated with this entity |
policies |
list (string) |
List of the policies set on this entity |
Alias Properties
These can be retrieved from identity.entity.aliases.
| Name | Type | Description |
|---|---|---|
creation_time |
string |
The alias's creation time in RFC3339 format |
id |
string |
The alias's ID |
last_update_time |
string |
The alias's last update (modify) time in RFC3339 format |
metadata |
map (string -> string) |
Metadata associated with the alias |
merged_from_entity_ids |
list (string) |
If this alias was attached to the current entity via one or more merges, the original entity/entities will be in this list |
mount_accessor |
string |
The immutable accessor of the mount that created this alias |
mount_path |
string |
The path of the mount that created this alias; unlike the accessor, there is no guarantee that the current path represents the original mount |
mount_type |
string |
The type of the mount that created this alias |
name |
string |
The alias's name |
Groups Properties
These exist at the identity.groups namespace.
| Name | Type | Description |
|---|---|---|
by_id |
map (string -> group) |
A map of group ID to group information |
by_name |
map (string -> group) |
A map of group name to group information; unlike the group ID, there is no guarantee that the current name will always represent the same group |
Group Properties
These can be retrieved from the identity.groups maps.
| Name | Type | Description |
|---|---|---|
creation_time |
string |
The group's creation time in RFC3339 format |
id |
string |
The group's ID |
last_update_time |
string |
The group's last update (modify) time in RFC3339 format |
metadata |
map (string -> string) |
Metadata associated with the group |
name |
string |
The group's name |
member_entity_ids |
list (string) |
A list of IDs of entities that are directly assigned to this group |
parent_group_ids |
list (string) |
A list of IDs of groups that are parents of this group |
policies |
list (string) |
List of the policies set on this group |
MFA Properties
These properties exist at the mfa namespace.
| Name | Type | Description |
|---|---|---|
methods |
map (string -> method) |
A map of method name to method properties |
MFA Method Properties
These properties can be accessed via the mfa.methods selector.
| Name | Type | Description |
|---|---|---|
valid |
bool |
Whether the method has successfully been validated; if validation has not been attempted, this will trigger the validation attempt. The result of the validation attempt will be used for this method for all policies for the given request. |
Control Group Properties
These properties exist at the controlgroup namespace.
| Name | Type | Description |
|---|---|---|
time, request_time |
string |
The original request time in RFC3339 format |
authorizations |
list (authorization) |
List of control group authorizations |
Control Group Authorization
These properties can be accessed via the controlgroup.authorizations selector.
| Name | Type | Description |
|---|---|---|
time |
string |
The authorization time in RFC3339 format |
entity |
identity.entity |
The identity entity for the authorizer. |
groups |
identity.groups |
The map of identity groups associated with the authorizer. |