---
title: Hashicorp Vault – Configure Authentication - Inventive HQ
description: "There are many authentication methods for vault. This article describes how to configure LDAP authentication and Userpass Authentication LDAP Authentication: The following command will configure LDAP to point at a domain controller named mydomaincontroller.mydomain.com. It will then search the search base for groups to the top of mydomain.com domain: After you have configured vault to […]"
---

[blog](https://hs.inventivehq.com/blog)

# [Hashicorp Vault – Configure Authentication - Inventive HQ](https://hs.inventivehq.com/blog/hashicorp-vault-configure-authentication)

 Written by [Sean Conroy](https://hs.inventivehq.com/blog/author/sean-conroy) | Jan 13, 2025 9:54:28 PM

There are many authentication methods for vault. This article describes how to configure LDAP authentication and Userpass Authentication

### LDAP Authentication**:**

The following command will configure LDAP to point at a domain controller named mydomaincontroller.mydomain.com. It will then search the search base for groups to the top of mydomain.com domain:

```
vault write auth/ldap/config url=”ldap://mydomaincontroller.mydomain.com:389″ userattr=sAMAccountName userdn=“dc=mydomain,dc=com” groupdn=“dc=mydomain,dc=com” groupfilter=”(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=))” groupattr=”cn” upndomain=“mydomain.com” insecure_tls=false
```

After you have configured vault to use LDAP for authentication, you need to map the groups to policies. Here is an example of how to map the LDAP groups to the vault Policies:

```
vault write auth/ldap/groups/myvaultadgroup policies=myvaultpolicy
```

### Userpass Authentication**:**

**Create a user**:

```
vault write auth/userpass/users/myusername password=mypassword policies=admins
```

**Delete a user**:

```
vault delete auth/userpass/users/username
```

**Change user password**:

```
vault write auth/userpass/users/myusername password=mypassword
```

**Create user with random password and store password in cubbyhole**:

```
mypass=”$(openssl rand -base64 16)”
echo -n $mypass | vault write secret/test password=-
vault write auth/userpass/users/test.user password=$mypass policies=admins
vault read -wrap-ttl=15m secret/test
mypass=””
```

**Login using Userpass Authentication**:

```
vault auth -method=userpass username=myusername password=mypassword
```

**Login and have vault prompt for password**:

```
vault auth -method=userpass username=myusername
```

### Certificate Authentication

Vault supports using PEM certificates for authentication. However, it does not work with the verison of CURL built-in to OS X.

**Creating an Authentication Certificate:**

Create a folder to store files  
create cert.conf file and populate with text below  
Modify cert.conf to fill in all the fields under \[ dn \]  
<insert here>

Run the following commands and follow prompts:

```
openssl req -config cert.conf -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
openssl rsa -in key.pem -out key.insecure.pem
```

\*\*In the next step be sure to replace “Your Name”, your.name, and policyname

**Configure vault to accept authentication certificate**  
Run the following:

```
vault write auth/cert/certs/your.name display_name=”Your Name” policies=policyname certificate=@cert.pem ttl=3600
```

**Authenticate using the authentication certificate vault**  
Run the following command:

```
vault auth -method=cert -client-cert=cert.pem -client-key=key.pem
```

### Token Authentication:

**No Prompt for token**:

```
vault auth <token>
```

**Prompt for Token**:

```
vault auth
```

[View full post](https://hs.inventivehq.com/blog/hashicorp-vault-configure-authentication)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Sean Conroy"
  },
  "dateModified" : "2025-01-31T00:08:49.622Z",
  "datePublished" : "2025-01-13T21:54:28Z",
  "headline" : "Hashicorp Vault – Configure Authentication",
  "image" : {
    "@type" : "ImageObject",
    "height" : 709,
    "url" : "https://47453230.fs1.hubspotusercontent-na1.net/hubfs/47453230/Imported_Blog_Media/1507764526_featured.jpg",
    "width" : 1260
  },
  "mainEntityOfPage" : "https://hs.inventivehq.com/blog/hashicorp-vault-configure-authentication",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "blog"
  }
}
```