4ffb21f9ca
* Update documentation to include RDP in credential injection * Update FAQ on Boundary and Vault integration Fixed typo. * update documentation on credential stores and workflows for RDP * update static credential store documentation to include upd credential creation * update documentation for credential injection setup * Update 'credentials create' command documentation for upd credential type * fixed typo in UPD options * Update create.mdx with instructions for RDP targets * Create rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update to mention ldap secrets engine * Update rdp-testing-and-compatibility-matrix.mdx to get rid of ticket number * updated to include mention of vault kv and chad suggestions Updated with Chad's suggestions and vault kv * Update rdp-testing-and-compatibility-matrix.mdx Found another place where I neglected the vault kv * docs: Style updates * docs: Clean up beta references, adds update commands * docs: Edits, update domain model topics * docs: Add target address caveats * docs: Edit network config section * docs: Use custom port number to connect * docs: Adds anchor link, beta tag * docs: Respond to feedback * docs: Cleanup for consistency, remove known issue * docs: Cleanup and minor fixes * docs: Add link to create issue * docs: Add direct address note to targets CLI topics * Update website/content/docs/concepts/credential-management.mdx Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> * docs: Remove beta references from target and credentials * docs: Remove Vault cred store ID * docs: Remove SSH cert from brokered creds * docs: Remove session recording options * docs: Adds UPD to credential stores domain model topic * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Remove session recording options * docs: Update limitations and configuration * Update website/content/docs/credentials/configure-credential-injection.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Update default port commands * docs: Add known issue for error * docs: Fix typo * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Add certificate acceptance to Windows * docs: Reorder UPD options * docs: Add NTLMV2 to cred management statement * docs: Update Windows Remote Desktop Connection error * docs: Clarify domain behavior * docs: Fix back ticks on command options * docs: Update command format in definition * docs: Clarify port conflict with Remote Desktop app * docs: Update RDP target address caveat * docs: Release notes 0.20.0 * docs: Minor edit * docs: Vercel build * docs: Deletes older important changes --------- Co-authored-by: Dan Rohan <daniel.rohan@elastic.co> Co-authored-by: Dan Rohan <dan.rohan@hashicorp.com> Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
68 lines
4.9 KiB
Plaintext
68 lines
4.9 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Credential management with Boundary
|
|
description: >-
|
|
Credential stores let you store and manage credentials in Boundary. Learn about configuring user workflows with credential management or credential injection.
|
|
---
|
|
|
|
# Credentials in Boundary
|
|
|
|
When users connect to a target machine, they typically need a set of credentials for authentication. Rather than requiring users to securely store and manage credentials for every target resource, Boundary centralizes credential management to enhance security.
|
|
|
|
## Credential stores
|
|
|
|
Boundary supports credential management using [credential stores](/boundary/docs/domain-model/credential-stores), which are resources that store credentials for various targets.
|
|
|
|
There are two types of credential stores:
|
|
|
|
1. Static credential store
|
|
2. Vault credential store
|
|
|
|
Static credential stores are built into Boundary and store static credentials like username password, username password domain, or keypairs. Vault credential stores point to a HashiCorp Vault instance, which provides additional capabilities like generating short-lived dynamic credentials and integrating with external systems like Active Directory through the LDAP secrets engine.
|
|
|
|
Boundary can retrieve credentials from the credential stores and present them back to the user when they connect to targets. This workflow is referred to as **credential brokering**. Boundary can also inject credentials directly into the session on behalf of the user. This workflow is referred to as **credential injection**.
|
|
|
|
|
|
## End user workflows
|
|
|
|
End users can experience three workflows when they connect to a target. In the first workflow, when an end user connects to a target, Boundary initiates the session, but the end user must know the credentials to authenticate into the session. This workflow is available for testing purposes, but it is not recommended because it places the burden on the users to securely store and manage credentials.
|
|
|
|
The second workflow uses a feature called credential brokering, where credentials are retrieved from a credentials store and returned back to the end user. The end user then enters the credentials into the session when prompted by the target. This workflow is more secure than the first workflow since credentials are centrally managed through Boundary. For more information, refer to the the [Credential brokering](/boundary/docs/concepts/credential-management#credential-brokering) concepts page.
|
|
|
|
The third workflow uses a featured called credential injection, where credentials are retrieved from a credential store and injected directly into the session on behalf of the end user. This workflow is the most secure because credentials are not exposed to the end user, reducing the chances of a leaked credential. This workflow is also more streamlined as the user goes through a passwordless experience. For more information, refer to the [Credential injection](/boundary/docs/concepts/credential-management#credential-injection) concepts page.
|
|
|
|
The type of target you connect to also determines which credential workflows you can configure:
|
|
|
|
- **TCP targets** cannot have any injected application credentials
|
|
- **SSH targets** must have at least one injected application credential to establish the SSH connection
|
|
- **RDP targets** must have at least one injected application credential to establish the RDP connection
|
|
|
|
<Note>
|
|
|
|
RDP credential injection is currently in beta and requires HCP Boundary or Boundary Enterprise.
|
|
|
|
</Note>
|
|
|
|
For more information, refer to the [Target types](/boundary/docs/domain-model/targets#target-types) documentation.
|
|
|
|
## Credential types
|
|
|
|
Boundary supports several credential types to accommodate different authentication methods:
|
|
|
|
- **Username password**: Basic username and password authentication
|
|
- **Username password domain**: Username, password, and domain for Windows environments that use Active Directory authentication, commonly used for credential injection when connecting to an RDP target
|
|
- **SSH private key**: SSH private key authentication
|
|
- **SSH certificate**: SSH certificate-based authentication
|
|
- **JSON**: Flexible JSON-based credential storage
|
|
|
|
## Next steps
|
|
|
|
The following pages provide steps to configure static credentials using both a static credential store and a Vault credential store. You can also configure targets for either credential brokering or credential injection workflows.
|
|
|
|
- [Create a static credential store](/boundary/docs/credentials/static-cred-boundary)
|
|
- [Create a Vault credential store](/boundary/docs/credentials/static-cred-vault)
|
|
- [Configure targets with credential brokering](/boundary/docs/credentials/configure-credential-brokering)
|
|
- [Configure targets with credential injection](/boundary/docs/credentials/configure-credential-injection)
|
|
|
|
To learn more about what is supported for the RDP credential injection beta and to view known issues, refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix).
|