Create static LDAP roles

Configure static roles to map names in Vault to LDAP entries and use the rotation settings to manage credentials automatically with the role.

1. Create a configuration file, ldap-role.json with your role settings:

   {
     "role_name":       "<vault_role_name>",
     "username":        "<existing_ldap_username>",
     "dn":              "<existing_ldap_dn>",
     "rotation_period": "<credential_rotation_frequency>"
   }
   

   For example:

   {
     "role_name":       "hashicorp",
     "username":        "vault",
     "dn":              "uid=vault,ou=users,dc=hashicorp,dc=com",
     "rotation_period": "24h"
   }
   

2. Save the new role.

   CLIAPI

   Use vault write with the /{mount_path}/static-role path and your static role configuration, ldap-role.json, to create a new static role:

   $ vault write <mount_path>/static-role @ldap-role.json
   

   For example:

   $ vault write devcreds/static-role @ldap-role.json
   

   Make a POST call to /{mount_path}/static-role with your static role configuration, ldap-role.json, to create a new static role:

   $ curl                                                \
     --request POST                                      \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     --data @ldap-role.json                              \
     ${VAULT_ADDR}/v1/<mount_path>/static-role
   

   For example:

   $ curl                                                \
     --request POST                                      \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     --data @ldap-role.json                              \
     ${VAULT_ADDR}/v1/devcreds/static-role
   

3. Confirm the role settings by requesting credentials from the plugin:

   CLIAPI

   Use vault read with the /{mount_path}/static-cred/{role_name} path to fetch the credential information for the given role:

   $ vault read <mount_path>/static-role/<role_name>
   

   For example:

   $ vault read devcreds/static-role/hashicorp
   

   Make a GET call to /{mount_path}/static-cred/{role_name} to fetch the credential information for the given role:

   $ curl                                                \
     --request GET                                       \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     ${VAULT_ADDR}/v1/<mount_path>/static-role/<role_name>
   

   For example:

   $ curl                                                \
     --request GET                                       \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     ${VAULT_ADDR}/v1/devcreds/static-role/hashicorp