mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 22:25:24 +00:00
30 lines
1.1 KiB
Markdown
30 lines
1.1 KiB
Markdown
# HashiCorp Vault
|
|
|
|
Adds the `vault` SSH auth type: Termix signs you in to Vault with OIDC in the
|
|
browser, has Vault's SSH secrets engine sign a fresh key, and keeps the
|
|
short-lived certificate until it expires.
|
|
|
|
Termix talks to Vault's HTTP API directly (`auth/<mount>/oidc/auth_url`,
|
|
`auth/<mount>/oidc/callback`, `<ssh mount>/sign/<role>`). No Vault token,
|
|
AppRole secret or long-lived key is ever stored.
|
|
|
|
## Profiles
|
|
|
|
A profile holds the connection settings only: the Vault address and
|
|
namespace, the OIDC mount and role, the SSH secrets mount and signer role,
|
|
the valid principals and the key type. Pick one in the host editor after
|
|
choosing "Vault" as the authentication type, and manage profiles from the
|
|
same place. Users with the "Share Vault profiles" permission can share a
|
|
profile with everyone.
|
|
|
|
## Settings
|
|
|
|
Admin settings, under Settings > Plugins > HashiCorp Vault:
|
|
|
|
- **Redirect URI**: add it to `allowed_redirect_uris` in each Vault OIDC
|
|
role: `<base URL>/plugin-api/vault/oidc/callback`, or
|
|
`<base URL>/vault/oidc/callback` while "Use the old redirect URI" is on.
|
|
|
|
An install upgraded from 2.8 that used Vault keeps the old redirect URI
|
|
turned on.
|