Rotate root LDAP credentials on a schedule

You can set the rotation_schedule parameter with an optional rotation window in your LDAP configuration to rotate root credentials on a fixed schedule.

If you set the rotation window, Vault stops trying to rotate the credential once the window expires. If Vault cannot rotate the credential within the defined window (e.g., due to a network failure) it waits until the next scheduled rotation to try again.

1. You cannot set rotation_period and rotation_schedule for the same plugin. If you previously set a rotation period, you must disable period rotation in your configuration:

   OpenLDAPActive DirectoryRACF

   {
     "schema":            "ad",
     "binddn":            "<ldap_username>",
     "bindpass":          "<ldap_password>",
     "url":               "<ldap_server_uri>",
     "credential_type":   "<password | phrase>",
     "rotation_schedule": "<cron_style_time_string>",
     "rotation_window":   "<window_for_rotation_attempts>",
     "rotation_period":   "0"
   }
   

   For example:

   {
     "schema":            "ad",
     "binddn":            "cn=admin,dc=abc,dc=com",
     "bindpass":          "iamabadpassword",
     "url":               "ldaps://138.91.247.105",
     "credential_type":   "password",
     "rotation_schedule": "0 0 * * SAT",
     "rotation_window":   "1hr",
     "rotation_period":   "0"
   }
   

   {
     "schema":            "openldap",
     "binddn":            "<ldap_username>",
     "bindpass":          "<ldap_password>",
     "url":               "<ldap_server_uri>",
     "credential_type":   "<password | phrase>",
     "rotation_schedule": "<cron_style_time_string>",
     "rotation_window":   "<window_for_rotation_attempts>",
     "rotation_period":   "0"
   }
   

   For example:

   {
     "schema":            "openldap",
     "binddn":            "cn=admin,dc=abc,dc=com",
     "bindpass":          "iamabadpassword",
     "url":               "ldaps://138.91.247.105",
     "credential_type":   "password",
     "rotation_schedule": "0 0 * * SAT",
     "rotation_window":   "1hr",
     "rotation_period":   "0"
   }
   

   {
     "schema":            "racf",
     "binddn":            "<ldap_username>",
     "bindpass":          "<ldap_password>",
     "url":               "<ldap_server_uri>",
     "credential_type":   "<password | phrase>",
     "password_policy":   "<vault_policy_name>",
     "rotation_schedule": "<cron_style_time_string>",
     "rotation_window":   "<window_for_rotation_attempts>",
     "rotation_period":   "0"
   }
   

   For example:

   {
     "schema":            "racf",
     "binddn":            "cn=admin,dc=abc,dc=com",
     "bindpass":          "iamabadpassword",
     "url":               "ldaps://138.91.247.105",
     "credential_type":   "phrase",
     "password_policy":   "racf_password_policy",
     "rotation_schedule": "0 0 * * SAT",
     "rotation_window":   "1hr",
     "rotation_period":   "0"
   }
   

2. Apply the changes.

   CLIAPIGUI

   Use vault write with the {mount_path}/config path to apply your ldap.json configuration file:

   $ vault write <mount_path>/config @ldap.json
   

   For example:

   $ vault write devcreds/config @ldap.json
   

   Make a POST call to /{mount_path}/config to apply your configuration file, ldap-config.json:

   $ curl                                                \
     --request POST                                      \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     --data @ldap.json                                   \
     ${VAULT_ADDR}/v1/<mount_path>/config
   

   For example:

   $ curl                                                \
     --request POST                                      \
     --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
     --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
     --data @ldap.json                                   \
     ${VAULT_ADDR}/v1/devcreds/config
   

   • If you have the plugin landing page open, click Configure {plugin_type} >. Otherwise:

     1. Open the GUI for your Vault instance.

     2. Log in under the namespace for the plugin or select the namespace from the selector at the bottom of the left-hand menu and re-authenticate.

     3. Select Secrets Engines from the left-hand menu.

     4. Click the plugin mount you want to configure.

     5. Click Configure {plugin_type} >.

   • Select your LDAP schema.

   • Update the rotation details according to your configuration file.

   • Click Save.