Azure auth method
The azure
auth method allows authentication against Vault using
Azure Active Directory credentials. It treats Azure as a Trusted Third Party
and expects a JSON Web Token (JWT)
signed by Azure Active Directory for the configured tenant.
This method supports authentication for system-assigned and user-assigned managed identities. See Managed identities for Azure resources for more information about these resources.
This documentation assumes the Azure method is mounted at the /auth/azure
path in Vault. Since it is possible to enable auth methods at any location,
please update your API calls accordingly.
Prerequisites:
The Azure auth method requires client credentials to access Azure APIs. The following are required to configure the auth method:
- A configured Azure AD application which is used as the resource for generating MSI access tokens.
- Client credentials (shared secret) with read access to particular Azure Resource Manager resources. See Azure AD Service to Service Client Credentials.
If Vault is hosted on Azure, Vault can use MSI to access Azure instead of a shared secret. A managed identity must be enabled on the resource that acquires the access token.
The following Azure role assignments must be granted to the Azure AD application in order for the auth method to access Azure APIs during authentication.
Role assignments
Note: The role assignments are only required when the
vm_name
, vmss_name
,
or resource_id
parameters are used on login.
Azure Environment | Login Parameter | Azure API Permission |
---|---|---|
Virtual Machine | vm_name | Microsoft.Compute/virtualMachines/*/read |
Virtual Machine Scale Set (Uniform Orchestration) | vmss_name | Microsoft.Compute/virtualMachineScaleSets/*/read |
Virtual Machine Scale Set (Flexible Orchestration) | vmss_name | Microsoft.Compute/virtualMachineScaleSets/*/read Microsoft.ManagedIdentity/userAssignedIdentities/*/read |
Services that (support managed identities) for Azure resources | resource_id | read on the resource used to obtain the JWT |
API permissions
The following API permissions must be assigned to the service principal provided to Vault for managing the root rotation in Azure:
Permission Name | Type |
---|---|
Application.ReadWrite.All | Application |
Authentication
Via the CLI
The default path is /auth/azure
. If this auth method was enabled at a different
path, specify auth/my-path/login
instead.
The role
and jwt
parameters are required. When using
bound_service_principal_ids
and bound_group_ids
in the token roles, all the
information is required in the JWT (except for vm_name
, vmss_name
, resource_id
). When
using other bound_*
parameters, calls to Azure APIs will be made and
subscription_id
, resource_group_name
, and vm_name
/vmss_name
are all required
and can be obtained through instance metadata.
For example:
Via the API
The default endpoint is auth/azure/login
. If this auth method was enabled
at a different path, use that value instead of azure
.
The response will contain the token at auth.client_token
:
Configuration
Auth methods must be configured in advance before machines can authenticate. These steps are usually completed by an operator or configuration management tool.
Via the CLI
Enable Azure authentication in Vault:
Configure the Azure auth method:
For the complete list of configuration options, please see the API documentation.
Create a role:
Roles are associated with an authentication type/entity and a set of Vault policies. Roles are configured with constraints specific to the authentication type, as well as overall constraints and configuration for the generated auth tokens.
For the complete list of role options, please see the API documentation.
Via the API
Enable Azure authentication in Vault:
Configure the Azure auth method:
Create a role:
Azure managed identities
There are two types of managed identities in Azure: System-assigned and User-assigned. System-assigned identities are unique to every virtual machine in Azure. If the resources using Azure auth are recreated frequently, using system-assigned identities could result in many Vault entities being created. For environments with high ephemeral workloads, user-assigned identities are recommended.
Limitations
The TTL of the access token returned by Azure AD for a managed identity is 24hrs and is not configurable. See (limitations of using managed identities) for more info.
Azure debug logs
The Azure auth plugin supports debug logging which includes additional information about requests and responses from the Azure API.
To enable the Azure debug logs, set the following environment variable on the Vault server:
API
The Azure Auth Plugin has a full HTTP API. Please see the API documentation for more details.
Code example
The following example demonstrates the Azure auth method to authenticate with Vault.