4ffb21f9ca
* Update documentation to include RDP in credential injection * Update FAQ on Boundary and Vault integration Fixed typo. * update documentation on credential stores and workflows for RDP * update static credential store documentation to include upd credential creation * update documentation for credential injection setup * Update 'credentials create' command documentation for upd credential type * fixed typo in UPD options * Update create.mdx with instructions for RDP targets * Create rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update to mention ldap secrets engine * Update rdp-testing-and-compatibility-matrix.mdx to get rid of ticket number * updated to include mention of vault kv and chad suggestions Updated with Chad's suggestions and vault kv * Update rdp-testing-and-compatibility-matrix.mdx Found another place where I neglected the vault kv * docs: Style updates * docs: Clean up beta references, adds update commands * docs: Edits, update domain model topics * docs: Add target address caveats * docs: Edit network config section * docs: Use custom port number to connect * docs: Adds anchor link, beta tag * docs: Respond to feedback * docs: Cleanup for consistency, remove known issue * docs: Cleanup and minor fixes * docs: Add link to create issue * docs: Add direct address note to targets CLI topics * Update website/content/docs/concepts/credential-management.mdx Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> * docs: Remove beta references from target and credentials * docs: Remove Vault cred store ID * docs: Remove SSH cert from brokered creds * docs: Remove session recording options * docs: Adds UPD to credential stores domain model topic * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Remove session recording options * docs: Update limitations and configuration * Update website/content/docs/credentials/configure-credential-injection.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Update default port commands * docs: Add known issue for error * docs: Fix typo * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Add certificate acceptance to Windows * docs: Reorder UPD options * docs: Add NTLMV2 to cred management statement * docs: Update Windows Remote Desktop Connection error * docs: Clarify domain behavior * docs: Fix back ticks on command options * docs: Update command format in definition * docs: Clarify port conflict with Remote Desktop app * docs: Update RDP target address caveat * docs: Release notes 0.20.0 * docs: Minor edit * docs: Vercel build * docs: Deletes older important changes --------- Co-authored-by: Dan Rohan <daniel.rohan@elastic.co> Co-authored-by: Dan Rohan <dan.rohan@hashicorp.com> Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
95 lines
4.2 KiB
Plaintext
95 lines
4.2 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Configure targets with credential injection
|
|
description: >-
|
|
Configure credential injection so Boundary provides users with a passwordless experience when connecting to targets. Availabile exclusively for Enterprise users.
|
|
---
|
|
|
|
# Configure targets with credential injection
|
|
|
|
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
|
|
|
|
The following section provides steps to configure your targets with credential injection.
|
|
Credential injection provides end users with a passwordless experience when they connect to targets by automatically injecting credentials without exposing them to the user.
|
|
|
|
Credential injection is supported for:
|
|
- **SSH targets**: Protocol-aware SSH connections
|
|
- **RDP targets**: Protocol-aware RDP connections (BETA)
|
|
|
|
@include 'alerts/beta.mdx'
|
|
|
|
## Requirements
|
|
|
|
- This feature requires either <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a>
|
|
- You must have an existing target available that supports credential injection:
|
|
- **RDP targets**: Must be configured with at least one injected application credential
|
|
- **SSH targets**: Must be configured with at least one injected application credential
|
|
- **TCP targets**: Do not support credential injection
|
|
- You must have configured either a static credential store or a Vault credential store:
|
|
|
|
- To configure a static credential store, refer to [Create static credential stores](/boundary/docs/credentials/static-cred-boundary).
|
|
- To configure a Vault credential store and credential library, refer to [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault).
|
|
|
|
- You must have a static credential saved in your static credential store or Vault credential store. The credential must correspond to the target to which you want to authenticate.
|
|
|
|
- **For RDP targets**: Network Level Authentication (NLA) is supported. Kerberos and NTLMv2 authentication methods are supported for domain-joined workers. NTLMv2 is supported for non-domain-joined workers.
|
|
- **For SSH targets**: Keyboard-interactive authentication is not supported. When you use username-password credentials, ensure that your SSH server is configured to allow password authentication.
|
|
|
|
## Configuration
|
|
|
|
Complete the following steps to configure targets with credential injection:
|
|
|
|
<Tabs>
|
|
<Tab heading="UI" group="ui">
|
|
|
|
1. Log in to Boundary.
|
|
2. Select **Orgs** on the navigation pane.
|
|
3. Select your desired org.
|
|
4. Select the project where your target resides.
|
|
5. Click **Targets** on the navigation pane.
|
|
6. Click on your target you want to configure for credential injection.
|
|
7. Click on the **Injected Application Credential** tab.
|
|
8. Click **Managed** and select **Add Injected Application Credential** in the pull down menu.
|
|
9. Do one of the following:
|
|
- **If you are using a static credential store**: Select the credential that corresponds to your target and click **Add Injected Application Credential**.
|
|
- **If you are using a Vault credential store**: Select the credential library that corresponds to your target and click **Add Injected Application Credential**.
|
|
|
|
</Tab>
|
|
<Tab heading="CLI" group="cli">
|
|
|
|
1. Log into Boundary.
|
|
|
|
```shell-session
|
|
$ boundary authenticate
|
|
Please enter the login name (it will be hidden):
|
|
Please enter the password (it will be hidden):
|
|
```
|
|
|
|
2. Add credential injection to target.
|
|
|
|
```shell-session
|
|
$ boundary targets add-credential-sources \
|
|
-id trdp_vO60a7TwpI \
|
|
-injected-application-credential-source csvlt_Xqa6V6QwfM
|
|
```
|
|
|
|
<Tip>
|
|
|
|
If you are using a static credential store, `brokered-credential-source` refers to the ID of a **credential** in the static credential store.
|
|
|
|
If you are using a Vault credential store, `brokered-credential-source` refers to the ID of a **credential library** in the Vault credential store.
|
|
|
|
</Tip>
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
## More information
|
|
|
|
Refer to the following topics for more information:
|
|
|
|
- [Create static credential stores](/boundary/docs/credentials/static-cred-boundary)
|
|
- [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault)
|
|
- [Target types](/boundary/docs/domain-model/targets#target-types)
|
|
- [Credentials](/boundary/docs/domain-model/credentials)
|