Revoke a service account lease

The LDAP secrets plugin lets operators revoke the lease for checked out service account to force a password rotation.

Assumptions

You have set up an ldap plugin.
You have created an LDAP account library.
You know the full lease ID for the service account from the original account checkout.

Use vault lease revoke with the full lease ID of the service account to revoke the lease on a service account:

$ vault lease revoke \
  <mount_path>/library/<set_name>/check-out/<lease_token>

For example:

$ vault lease revoke \
  devcreds/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq

Make a POST call to /sys/leases/revoke with the full lease ID of the service account to extend the lease on a service account:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"lease_id": "<mount_path>/library/<set_name>/check-out/<lease_token>"}'  \
  ${VAULT_ADDR}/v1/sys/leases/revoke

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"lease_id": "devcreds/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq"}'  \
  ${VAULT_ADDR}/v1/sys/leases/revoke