HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Boundary
Boundary Home

Configure targets with credential injection

Enterprise

This feature requires HCP Boundary or Boundary Enterprise

The following section provides steps to configure your targets with credential injection. Credential injection provides end users with a passwordless experience when they connect to targets by automatically injecting credentials without exposing them to the user.

Credential injection is supported for:

  • SSH targets: Protocol-aware SSH connections

  • RDP targets: Protocol-aware RDP connections (BETA)

    Beta feature

    Beta functionality is stable, but possibly incomplete and subject to change. We strongly discourage using beta features in production deployments of Boundary.

Requirements

  • This feature requires either HCP Boundary or Boundary Enterprise

  • You must have an existing target available that supports credential injection:

    • RDP targets: Must be configured with at least one injected application credential
    • SSH targets: Must be configured with at least one injected application credential
    • TCP targets: Do not support credential injection

  • You must have configured either a static credential store or a Vault credential store:

  • You must have a static credential saved in your static credential store or Vault credential store. The credential must correspond to the target to which you want to authenticate.

  • For RDP targets: Network Level Authentication (NLA) is supported. Kerberos and NTLMv2 authentication methods are supported for domain-joined workers. NTLMv2 is supported for non-domain-joined workers.

  • For SSH targets: Keyboard-interactive authentication is not supported. When you use username-password credentials, ensure that your SSH server is configured to allow password authentication.

Configuration

Complete the following steps to configure targets with credential injection:

  1. Log in to Boundary.
  2. Select Orgs on the navigation pane.
  3. Select your desired org.
  4. Select the project where your target resides.
  5. Click Targets on the navigation pane.
  6. Click on your target you want to configure for credential injection.
  7. Click on the Injected Application Credential tab.
  8. Click Managed and select Add Injected Application Credential in the pull down menu.
  9. Do one of the following:
    • If you are using a static credential store: Select the credential that corresponds to your target and click Add Injected Application Credential.
    • If you are using a Vault credential store: Select the credential library that corresponds to your target and click Add Injected Application Credential.

More information

Refer to the following topics for more information:

Edit this page on GitHub