Extend a service account lease

The LDAP secrets plugin lets clients extend the lease for checked out service accounts as long as the renewal does not violate the maximum TTL of the service account.

Assumptions

You have set up an ldap plugin.
You have created an LDAP account library.
You know the full lease ID for the service account from the original account checkout.

To extend a check-out so the current password lives longer, renew its lease.

Use vault lease renew with the full lease ID of the service account to extend the lease on a service account:

$ vault lease renew \
  <mount_path>/library/<set_name>/check-out/<lease_token>

For example:

$ vault lease renew \
  devcreds/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq

Make a POST call to /sys/leases/renew with the full lease ID of the service account to extend the lease on a service account:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"lease_id": "<mount_path>/library/<set_name>/check-out/<lease_token>"}'  \
  ${VAULT_ADDR}/v1/sys/leases/renew

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"lease_id": "devcreds/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq"}'  \
  ${VAULT_ADDR}/v1/sys/leases/renew