+
+If a user wants to abstract the authentication process using brokered credentials, they can use the `boundary connect` ssh-style command, and pass credentials to sshpass, PuTTY, or another such tool.
+In this scenario, while the brokered credential may not be visible to the user, they still interact with the brokered credentials to perform authentication.
+
+
+
+Additionally, with Vault's dynamic secrets engine, an administrator could configure their environment such that secrets are essentially one-time passwords, as the credentials are revoked after the session is terminated.
+
+Learn more about [credential brokering](/boundary/tutorials/hcp-getting-started/hcp-getting-started-credentials).
+
+Learn more about the [Vault dynamic secrets engine](/vault/docs/secrets).
+
+## Credential injection HCP only
+
+Credential injection is the process by which a credential is fetched from a credential store and then passed on to a worker for authentication to a remote machine.
+With credential injection, the user never sees the credential required to authenticate to the target.
+This provides a passwordless experience for the user, as the worker does both session establishment and authentication to the target on behalf of the user.
+This process differs from credential brokering, where credentials are returned to the user rather than injected into the session on worker nodes.
+
+The credential injection process works as follows:
+
+1. The user authenticates to Boundary.
+1. The user requests a connection to a target.
+
+ The controller fetches credentials from the credential store.
+1. The user establishes a connection to the session.
+
+ The controller assigns the job to a worker, and the worker establishes a session to the target.
+ Then the controller passes credentials to the worker.
+ The worker authenticates to the target, and the user is then authenticated to the target.
+
+Credential injection is available for the SSH target type, allowing users to inject the following credential types when accessing targets using SSH:
+
+- SSH certificates
+- Usernames and passwords
+- Usernames and public keys
+
+### Security considerations
+
+Consider a scenario where a user wants to access a target using SSH.
+
+
+
+In this scenario, the user must be authorized to access the target.
+If they are authorized, they have the ability to connect to the worker.
+Upon connecting to the worker, the worker attempts to establish a remote session to the target, and attempts authentication on behalf of the user.
+
+
+
+If the user is not authorized to access the target, the credentials are not injected on their behalf, nor are the credentials brokered back to them.
+
+Learn more about [credential injection](/boundary/tutorials/hcp-administration/hcp-ssh-cred-injection).
\ No newline at end of file
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index 21f9cd195..e7b0d4f69 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -211,6 +211,10 @@
"title": "Service Discovery",
"path": "concepts/service-discovery"
},
+ {
+ "title": "Credential Management",
+ "path": "concepts/credential-management"
+ },
{
"title": "Security",
"routes": [
diff --git a/website/public/img/credential-brokering.png b/website/public/img/credential-brokering.png
new file mode 100644
index 0000000000000000000000000000000000000000..27e3dce9fa362bd6076c1eed4692abbad6cc446c
GIT binary patch
literal 22726
zcmd?PWl&sg)Fq0$ySux)ySuwXa1Cz3odgdK!QBb&1cJK+cXzjG;Qi*_|M$n8s;TOx
zy6D~Kob7w9{X{4!NW#P5zyJXO!AnbtsQ>{14*=f5P!NFslwSrY00F@Xei0Q_k`@&u
zQgU{%_+o1g1SA!aqzS2|I)ss>`y*b+DpwY|9eN6yh&&iW$P3vvm`sR@7~)$bzP_5{
zi3u=n3r*eva1Ci>h@}kO?wrbs9$N4FpdJUE3R`2K2Sbkw|oFlx$#^c#V-44X#gk$dx zLA$pYP-MuTh%5+m__cg$ZmD0J%Lz)dHP+VRXD3!trxrZPo~2w86sI@xVI+ z*TAk~#_E~r**0%Gm2`}@pPZkab`sj(Sygo&d;YHJEz2))aovlcebrPjgm3XW#d%sP zI8vVHbs$@9US#hmd!jhot<(M8WU#`}^71g2(Hh)pem8Tb{*SZG@Fnbo(7TntB~B2^ zYvPvabt6;qpClszCg1B6>l^fqbiZms5&O7a7XA_Z!HI{!spmNCWYoBCfxq>$_RZAp zPHrd2tMw7#^4gWmv-SDSCg-EW*ETorWj-WU$2a}e*738y0{i|858p3pZd5Oein5D* zh<&x6W^Zk#o5CI3A+I1H#qpRWZ)pR%BQ4B;&b=UkX3&7F&V3}XDFxq#U`Pb(hLP?S zwfrO!(Gh_T*WbKt37=aJK#bNnJf6QjT5kb|=YqtqgDYvyZ}7NkBxKSSgg}i0r{{MR z?iB?2t8QD45pKTz23Jw%Ja>6ww4wBoPT1Tr1t1D8b1i8Ld3hijz-K5R;IJ=1V1Q4+ zfHw}{4Fm*|1M)xr0UpQ!{okL1-@g=U;baH=1(FsMR`UQp$%G8R>rV@LOB?03PHGtD z1`?41i6Da}6N3m0L7EKMIOTHLg~K|&${YvI7z
@)#QJ1SJz}phzNiR|NrYHbPVlbLI~b31STc~ z_9INl=#CTCx8u=tG(qJDUrDT*3_pQ?mnPx){n{wi!%f%*PZXYMvlI;;G7>N{lyHvo zbdva@c1fp{{N32iuL85+1^skU QQV >8uqnhe#H$dp$JU4JvSyd!vbaUwRxY{;gq&7ayQZL`NC4I0r zDkXiDn@9?a7%0>=a)yXxwU9H+97^ec7Wr P zY(Zh+s@|cYjyzDNiB9Rf3NhzTynI|2aVL~_OCf=2$&{B|EYf#+jT?A8n9lR0?GBwk zfN0Fo|LyQ!A;aY@obkCibvbg59(9pl69*_pgaB1tpPH0u4f=$+upHHxHog}Zq{S)b zbebk=_oqwb>ggZ0xqGtd%8*RW`#pd)k=M)mwOJpR>+_#lXbkMc3!AB?E1Nx{&3Arn z;O9TdL`Apand)*E+r2BhZUR!Ce5{ddhdF|8&%OACA@%@MnfED?m}8@w0OP!Mnwq81 zIofbLCHdWOM5j<->v)PkSJy1$Y2AJQ{gtV+J6#l|=j9xIc8;zbXB1a@cg5xpAbdGx z>12Ht|3vidqE;UGy26y@ZBnnFovSNnqUt8DH|D?oy!%PW3dFDeIK#`#A>FghTQ;Vk zU;FmvA)lU 9+LsO+RGV6CZ;Hx?T?@L+U3`RT%a-6kv}T3ii%FRZ?0E 8@6nzr5$Hml(cW>&QSB# zu|wawJ1lyFcg_CGZqci2SMR#syvuXdcNy+znsWTW!fEd;W#Q)SO5%?T)?;FZ=cN(v zaXia>r!E|YgnEfE$|Kr)_;69KOTy0fPNJKPQ3ow2{g^?E+sW@%@biPfIW^OgkPsbW zrlg(KPBDx(exOqKYA3LS;$(2azZ(rkwU2|RW2|-=$1^#=E~)fy!jg-_GmQ@x_z1Bv z=xPTe3W?q{?^`Cd5Q{Lm7)XS1>?$_+N+6lQ{9oMJF-OfS*u{9_oyoWGZa-xAV)`Z= zR+xrkp30PhzI@64i+Eb0_?bzXs8Bf}hxekb%g3mX%PV(PR;-mroTm+Eulw?UMWy3O zzjxl8V&uQIoH>*ozwG!_S$#bh%2drf3^{uyRI9_-wltX!@U8anPB(Vhl4>jCyP6?R zPR_FK;7N&nn-ihg#?lSQQ-6 oM7JLOVtN&YDs87~MwvYTi?W$E05Z zS3MH>KbIX&wdZ`)%hps?+loc-EqX)Iw^mG^xx^`?Vryn?XCdC7I$RM1xN{9b+%$z% z0msUHb=eD69bx;WDkY|lug%hoGt$yxxs6; zz_j8Q7`)rMPxjNG#M82=jSe`Qt5R+zr)9IJ5{lae5hwkCVQh^!oz6!fU&sRaO|nb| zSe$D29!GRKRF6;8)|1oHj@CZxAvEP>{f@mWEiZ2bSFEbrD!guV*^PC^GX-xk|M#{| z^VcM5-bGT&ovkpph}WaKQGU>4HN%+0Q3yEHFDlzTN?5|$2bC=M!xvISAjk7u58(!1 zZ@&cT%A>ELI} _Z_J(5QcgsH~VWfqI zHvZQ8@n6MG3~-pAUArwTT0JhSjNAA87Fd@af~cPM_L9(a946?`+5C7lF2^;NW&V3V zbaEYr=BxVR=`ap$f6n&rm}#xqe6wcXL10 d}l@ZsIl*76oe03(sQkv z2BOecS9RhR-4UKY=g;nz>g(Iyyt(l#l_Qw((9lEQ+f{Qs5bjWQSzpF<*ivs?Rn4qT zCtt8GyG%5$!0J^}YEhB*MJ!7{HTP`(Qy3<_Tv_R%9luPpoi+~6zTP*#s7dEYyZ!>& z!v S!Zp!> znjz)^r(NnpWO7F^5kgRY_z=I5SSvL&k8eolJG;MjN$ElJG6@=4=+9Cd_A=RL>~-2< z&t8}8(YB2BNn}&*$B`ZOwL}-Uq4`g?(?IFE=E|Myoui$y0wevzpxa_67^C;G(L7X; z@0(~59u$tF0)1(yJ|c?3SxSF0Wyf*YyAWT8{(HGZ~hxWpgCBdc=o(Dj79fVO6k{ z>~wx1yBkwWA}4X2U}_7S)EFW34|Rg~zIj~4og7GEkUF}bMB|u;+05~~FZ{H04bSXB z!h(p{z8ImWa|M4Wvg5Y_ _!H`+O%`Z?mBr zZ-Siw?&POeTSiS8LiJjR7)$|F6B91+LhaZZe(oyYkLCjmRlS|^O(3FZoWLw!vR>cX zR?#^MhV>X1Gp=THQ!YA!W^jSPVoCBnxx~86!4|kI&euiM{9~)x*!~ na!UXI znyq>i0_as*-N$R9n0<6DWn+%(xK0-QtQ=9_UNF)@lTB?E#6AZMX{ZrELtpSH%pdT? zW6TtU*(xdQ->Fy0ouVDYii~fJdhgR9DC?~QS?$i51FU#s6{KHxse|mEiC5_30}8~Q z<4uqM%;xxh^pfvTIphb@tPl&63EmC7>im<2-_IynC;gef>*R5O6AdmTh9-XqMnF}A z`U@);s?z^V!1oGPLP!I2TVM`g7ly~9E$^K3##(?;>3NnY-t7;qKm@esaXi!U^ intmQ$3V14fVJ2mr6@jN&wI*_^6^>p=)F?NMkO^lOsJ}oG4;pg$!qMjtZ%^=D;M_67mxHDdjOwigm-+HiUp-hR 1IQ2NDDPLuuaICqSzEaKUoIn|MSfC$<*^4+8;sOwf-{RN90gl9Nc&eMXF8^WqH zRfbGU5;0Wrf0XS76s;1#xd$ki>Z#sMFeDd%e_NE_=dpQVn20kNdmOsR1@Uw6NP0iH zSpG^swuTy>{^S0D>$VO&f0K(2Wu1e$oK|)_tZ^B`G6{mfppgIaeUWi6wNDU){9}Uo ziE7k2AT4=apEmutJRuyyadvDx#xQhl&-^EEXIHYj;$!XrMwX%hp=00OE?h*%jA^u6 zM$kH2{SD1op;io+WC|xPwfy1GA*lPqXO0kGoXPWn-Z@Tb3+HI* wq@&B|fKtBcofB=1n_Z|;;O#}nxcvLK%cPG5R0AGRr zAM_OxIY=rP*8>G-G|IALmP9Ob1{-?vhsMHPM;B`8<8ed&%L~%!Ji `u3I{+ZtPaE69^K*4xg_`?WJAYb~M z+E11*7}w5cAFFP?${8s@liiQG2FBxzx|cD}HPgTi&QEXXpL|3yG1YR;NQCgSs=+Xb z%&8}+q0>dk=`6rN0;5 siKj8I3{ob8Gr)uy)(5x z>skl^*y*QINB;N_7CMId!#oh%K1TQ9)O8U6uwxiO6PNxFCi)5xHXSsu#Q1QsBQe0s zm==+FWFNvvya3@E(<;{Y=zed}02BzzDz5y2c96sI0Vr^xW Ctf?+`RrkMf`29C(=5v~ND&uCxnj z3|rOw+X^BEd>35p>Kni7bBLQ?r?-s;h=F1|XZ7#K%E#FbME>Bk5p%$$^~u){tbuq8 zz<5NAmbtGKuf0GzFTL7(RhV}g%Wc5;jP|dd+-G&yZ(ClHIPbhJhl2EBl_dfC6!#U| z5LttP6d9^%ZQQJ+ZpdS69Np>K0hzOCr$FZf>mEacRZ5T2_}~WePwxPs2SAZ=1K(*N zlY0)3nOxGcl+`JBVe24 >$0tpf%7|BWT zbeMMkEN|{8;lE5>RYvY2%5_{VFG+D}lkrHsAwn2FePR!S>>j-lTix?XfglA+p@f@l zrArOy8b=8ofhh?i7fYrWVa=*~sGPT@{h0E4t``Rk8M6TU>u2&u>V-jfQF~op(Rt6w zU71xIyC%Xn?77hj)-H)hjrd^g2{#-lj{yOQoE8P4*qS3a^l#}<>zR$5yo0rt<6_fQ zSX>g-Qn-SvhfVhEZv!zj+${%7N_t{BnP7m4H#4VR7Z2G;-P-P0VpCS!bUWI#uuIg$ zHf-D09YYc`3J_O@ J&PpAo>*X>~4_-G5u2E k$gE)r)l*dID z>sGVrh_kbrb##iHDxY}HcR >VAeU^$GT|Uk1uTBCmBER>tqi8@~=p;o{(Uxs4#|;Atx>-~h%H@ NyiAjQGLKK{!(4?sG4y*?%i#v7vnzJZPYrc{M_3&+{=D*hv{5d? z)mQ~&oJ5uAc{sGo?L4K)!D+a$tpBA09#<`C2`?HjLCC(BRW?(!3MwR{pwuz8$ZqD< zOXt6-OZTVMF~!a%X{DG3^^dcJ>}{5|riONaD(DCq80;DiiAYe-ZZo$qSFv2)*f u zZm!BOOvU88e5xbYz;}hF;bHzpj|&s;qlzZH73aV793JOJDdr)0TV5cx>OYgrwXt&e z3aW|BTy0YPtr{FU@SO!u0HtM}0R(yr%dpEk1CVe79CnWjW88ast