Frequently asked questions

This FAQ answers Boundary's most common questions about networking requirements, Vault integration, identity provider support, and session monitoring.

Q: What are the networking requirements for Boundary?

Boundary workers require inbound access from clients. Workers do not necessarily need exposure to the public internet. If the client is coming from a private network, such as a corporate network, the worker needs to allow connectivity from the private network. If the client is coming from the public internet, the worker needs to allow connectivity from the public internet. Boundary also supports multi-hop sessions, which chain workers across network boundaries and support environments with strict outbound-only policies. The worker networking requirements provide additional details.

Q: Does Boundary require Vault? What is the integration story?

While Vault isn't a required secrets backend for Boundary sessions, the potential for Boundary and Vault integration is a core part of Boundary's overall value proposition for identity-based access. There are three primary points of integration with Vault:

1. Vault can be used as a secrets backend for Boundary, offering single sign-on to end target systems through credential brokering. This was covered in Boundary's 0.4 announcement and there are ample tutorials of this scenario.
2. Boundary can use Vault as an OpenID Connect (OIDC) provider to enable sign-in with Vault's supported auth methods (even non-OIDC auth methods like Active Directory Kerberos/LDAP). This scenario is covered in the tutorial.
3. Boundary can use Vault as the external key management system (KMS) that serves as Boundary's root of trust. More information on this use case can be found in the KMS configuration documentation.

Q: What identity providers does Boundary support?

Boundary supports password, LDAP, and OpenID Connect (OIDC) authentication. OIDC authentication supports many identity providers (IdPs), including Okta, Microsoft Entra ID (formerly Azure AD), Auth0, and other compatible providers. Boundary also supports LDAP authentication natively. Users can also log in using an OIDC bridge identity provider, such as Vault's OIDC bridge or Dex. Refer to the Boundary authentication documentation and auth method documentation for more information.

Q: Does Boundary support multi-factor authentication (MFA)?

Boundary supports MFA through an OpenID Connect (OIDC) identity provider that enforces it, such as Microsoft Entra ID, Okta, Auth0, and other providers. The identity provider performs the MFA challenge, and Boundary receives the authenticated identity. Boundary evaluates permission claims from an IdP-managed identity to determine managed-group membership. Managed groups support dynamic role assignments based on identity attributes. See Boundary's managed groups capabilities.

Q: How does Boundary discover targets and handle host IP address changes?

Boundary discovers new targets in two primary ways:

1. Boundary's Terraform provider supports discovery of targets provisioned by Terraform.
2. Boundary's dynamic host catalog queries infrastructure providers without an agent to automate the onboarding and configuration of hosts.

These methods automate the discovery and configuration of targets when their IP addresses change. You can also add static hosts manually through the Boundary Admin UI and CLI.

For more information on dynamic host catalogs, refer to:

• AWS dynamic host catalogs
• Azure dynamic host catalogs
• GCP dynamic host catalogs

Q: Does Boundary support live session monitoring and termination?

Session logging and monitoring: Boundary creates a session log for sessions between identities and targets onboarded to Boundary. Refer to the Manage sessions tutorial to learn how to monitor these sessions. Boundary supports audit logs and audit log streaming for HCP Boundary. You can export audit logs for both distributions to security information and event management (SIEM) or business intelligence (BI) tools.

Session termination: Boundary administrators can terminate sessions, as demonstrated in the Manage sessions tutorial.

Q: As an AWS user, can IAM roles be used to configure Boundary's dynamic host catalog?

Yes. Boundary supports IAM role authentication for AWS dynamic host catalogs through AssumeRole. The role must be assigned to a self-managed worker in the AWS account, and the host catalog must use a worker filter that matches the worker. Refer to the AWS dynamic host catalog documentation for more information.