Configure password authentication

The password auth method authenticates users against credentials that Boundary stores and manages directly. Unlike OIDC or LDAP, password auth methods do not require an external identity provider, which makes them useful for initial setup and for accounts that do not need to authenticate against a third-party system.

Password auth methods do not have an operational state. Unlike OIDC and LDAP auth methods, they are always available for authentication and do not need to be activated.

Create a password auth method

Log in to Boundary.
Select the scope in which you want to create the auth method.
Select Auth Methods, then click New.
Select Password, and complete the following fields:
- Name: (Optional) An optional name for identification purposes.
- Description: (Optional) An optional description of the auth method.
Click Save.

$ boundary auth-methods create password \
  -scope-id $SCOPE_ID \
  -name "corp-password" \
  -description "Password auth method for corp scope"

By default, login names must be lowercase and at least 3 characters, and passwords must be at least 8 characters. Set -min-login-name-length or -min-password-length to change these requirements.

Refer to the auth-methods create command documentation for more information.

Apply the following Terraform configuration:

resource "boundary_auth_method_password" "corp_password" {
  name        = "corp-password"
  description = "Password auth method for corp scope"
  scope_id    = "SCOPE_ID"
}

Replace scope_id with the ID of the scope in which you want to create the auth method.

Refer to the boundary_auth_method resource documentation for more information.

Create an account

An account links a login name and password to an auth method. If you do not set a password, Boundary disables the account.

Select the password auth method you created.
Select the Accounts tab, then click New.
Complete the following fields:
- Name: (Optional) An optional name for identification purposes.
- Description: (Optional) An optional description of the account.
- Login Name: (Required) The lowercase login name for the account.
- Password: (Optional) The account's password.
Click Save.

$ boundary accounts create password \
  -auth-method-id $PASSWORD_AUTH_METHOD_ID \
  -login-name "myuser" \
  -password "env://BOUNDARY_ACCOUNT_PASSWORD" \
  -name "myuser-account"

Pass the password using an environment variable or file reference instead of typing it directly on the command line.

resource "boundary_account_password" "myuser" {
  name           = "myuser-account"
  description    = "Password account for myuser"
  auth_method_id = boundary_auth_method_password.corp_password.id
  login_name     = "myuser"
  password       = "PASSWORD"
}

Create and link a user

Boundary automatically creates a user the first time someone authenticates successfully using a scope's primary auth method. If the password auth method is not primary for its scope, or you want to control user creation explicitly, create the user and link it to the account yourself.

Select Users, then click New.
Complete the Name and Description fields, and select Save.
From the user's Accounts tab, select Manage, then select Add Accounts.
Select the account you created, and select Add Accounts.

Create the user.

$ boundary users create \
  -scope-id $SCOPE_ID \
  -name "myuser" \
  -description "My user resource"

Link the user with an account.

$ boundary users set-accounts \
  -id $USER_ID \
  -account $ACCOUNT_ID

Authenticate

$ boundary authenticate password \
  -auth-method-id $PASSWORD_AUTH_METHOD_ID \
  -login-name "myuser"

More information

Refer to the Auth method and Account domain model topics for the full list of password auth method and account attributes.
Refer to Permissions in Boundary to learn how to assign roles and grants to a user.
To learn more about managing users, refer to the CLI users topic or the API User service topic.