Cryptographic Security Platform Vault supports user authentication through an OpenID Connect provider. If a provider is configured, the Cryptographic Security Platform Vault login dialog contains not only the Cryptographic Security Platform Vault Sign In button but also a configurable button to start the authentication process using the provider.

Important:

  • For OpenID Connect login to be successful across all vaults, you must provide AD/OpenLDAP service credentials, and the credentials must be active.

  • When the user has been authenticated via the OpenID Connect provider, the same username is used to obtain the LDAP permissions to Cryptographic Security Platform Vault. Therefore, the User Principal Name (UPN) used for the OpenID Connect provider must match a configured user on the LDAP server.

  • OpenLDAP does not support the UPN parameter. This might cause problems because the OpenID Connect provider might be unable to authenticate users if it cannot return a valid UPN. Workaround: Set the sn field in the OpenLDAP server to the UPN for the registered user. This allows you to import OpenLDAP users correctly into the provider's database. The users can then authenticate with the provider in Cryptographic Security Platform Vault.

Before You Begin 

The OpenID Connect provider must be configured to accept the Cryptographic Security Platform Vault URLs. Each login dialog requires both a login and a logout URL, so for Cryptographic Security Platform Vault, you have to configure 2 URLs for each node in the cluster. You have to configure the login and logout URL for Cryptographic Security Platform Vault, these 2 URLs are also sufficient for all types of vaults.

In the following example of URL list for OpenID Connect provider, KC_IP is the hostname or IP address of the Cryptographic Security Platform Vault agent:

<https://KC_IP/v5/oidc/callback>
<https://KC_IP/v5/kc/oidc/logout>

From Cryptographic Security Platform Vault 10.1.1, the Cryptographic Security Platform Vault appliance and the various types of vaults support multiple IDP servers. Each vault can have a separate IDP configured or can have different applications of same IDP configured for OIDC authentication.

Procedure 

  1. Log into the Cryptographic Security Platform Vault Management webGUI using an account with Security Admin privileges.
  2. In the top right, click the Switch to Appliance Management link.
  3. In the top menu bar, click Settings.
  4. In the Type drop-down list, select OpenID Connect.

Specify the options you want to use. When you are done, click Apply.

Field

Description

Client ID

The organizational identity assigned by the OpenID Connect provider when you sign up for the service.

Client Secret

A cryptographic component used to secure the organization's access to the OpenID Connect provider.

Important: This field is write-only. It will never be displayed again after it has been initially created. It can be reentered if necessary.

Base URL

The URL that Cryptographic Security Platform Vault will use to contact the OpenID Connect provider to present the login page.

Name

A user-defined name for the OpenID Connect provider. Cryptographic Security Platform Vault displays this name on the button on the login dialogs.

Only one global OIDC provider can be configured per Cryptographic Security Platform Vault cluster. The same button appears and the same OIDC authentication method is used on the login dialogs to Cryptographic Security Platform Vault, the Cryptographic Security Platform Vault for KMIP webGUI, and the Cryptographic Security Platform Vault for Secrets webGUI.