/sys/config/group-policy-application

The sys/config/group-policy-application endpoint can be used to configure the mode of policy application for identity groups in Vault. This setting dictates the behavior across all groups in all namespaces in Vault.

Vault allows you to add entities and groups from any namespace into an identity group. However, historically, any policies attached to that group would only apply when the Vault token authorizing a request was created in the same namespace as that group, or a descendent namespace. This endpoint allows relaxing that restriction: when the mode is set to the default, within_namespace_hierarchy, the historical behaviour is maintained, but when set to any, group policies apply to all members of a group, regardless of what namespace the request token came from.

Note that this configuration will be replicated between primary and secondaries, that is to say, primaries cannot have a different policy application mode to secondaries.

Get group policy application information

This endpoint returns the current group policy application mode, which will be either within_namespace_hierarchy or any.

Sample request

$ curl \
  --header "X-Vault-Token: ..." \
    'http://127.0.0.1:8200/v1/sys/config/group-policy-application'

Sample response

{
   "group_policy_application_mode": "within_namespace_hierarchy"
}

Set group policy application information

This endpoint allows you to modify the current group policy application mode, which can be either within_namespace_hierarchy or any. within_namespace_hierarchy restricts policy application to only policies from groups from parent namespaces, and any does not restrict policy application in any way, and policies will apply from any namespace, irrespective of namespace hierarchy.

Sample payload

{
   "group_policy_application_mode": "any"
}

Sample request

$ curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data @payload.json \
  'http://127.0.0.1:8200/v1/sys/config/group-policy-application'