Ashlee M Boyer
e6be6431b2
* Adding docs-content-check-legacy-links-format workflow * Adding test-link-rewrites workflow * Migrating links to new format
87 lines
3.7 KiB
Plaintext
87 lines
3.7 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Domain Model - Credential Libraries
|
|
description: |-
|
|
The anatomy of a Boundary credential library
|
|
---
|
|
|
|
# Credential Libraries
|
|
|
|
A credential library is a resource
|
|
that provides [credentials][]
|
|
of the same type and same access level
|
|
from a single [credential store][].
|
|
|
|
## Attributes
|
|
|
|
A credential library has the following configurable attributes:
|
|
|
|
- `name` - (optional)
|
|
If set, the `name` must be unique within the credential library's parent
|
|
[credential store][].
|
|
|
|
- `description` - (optional)
|
|
|
|
### Vault Credential Library Attributes
|
|
|
|
A Vault credential library has the following additional attributes:
|
|
|
|
- `path` - (required)
|
|
The path in Vault to request credentials from.
|
|
|
|
- `http_method` - (optional: defaults to `GET`)
|
|
The HTTP method the library uses when requesting credentials from Vault.
|
|
Can be either `GET` or `POST`.
|
|
|
|
- `http_request_body` - (optional)
|
|
The body of the HTTP request the library sends to Vault when requesting credentials.
|
|
Only valid if `http_method` is set to `POST`.
|
|
|
|
### Vault Credential Library Parameter Templating
|
|
|
|
In some cases it can be useful to provide information about a Boundary user or account when making a call to Vault. For example, this can allow picking the correct role when asking for database credentials (if roles are separated per-user), or providing a value to encode in an X.509 certificate generated by Vault. As of Boundary 0.11.1, you can template user and account information into either the path in Vault, the `POST` request body, or both.
|
|
|
|
The following Vault template parameters are supported in Boundary.
|
|
Note that account values are tied to the account associated with the token used to make the call:
|
|
|
|
- `{{.User.Id}}` - The user's ID.
|
|
- `{{.User.Name}}` - The user's name from the user resource.
|
|
- `{{.User.FullName}}` - The user's name from the account corresponding to the primary auth method in the user's scope.
|
|
This value may not be populated, or it may be different from the account name used in the template.
|
|
- `{{.User.Email}}` - The user's email address from the account corresponding to the primary auth method in the user's scope.
|
|
This value may not be populated, or it may be different from the account name used in the template.
|
|
- `{{.Account.Id}}` - The account's ID.
|
|
- `{{.Account.Name}}` - The name of the account from the account resource.
|
|
- `{{.Account.LoginName}}` - The account's login name, if a login name is used by that type of account.
|
|
- `{{.Account.Subject}}` - The account's subject, if a subject is used by that type of account.
|
|
- `{{.Account.Email}}` - The account's email, if email is used by that type of account.
|
|
|
|
Additionally, there is currently a single function that strips the rest of a string after a specified substring.
|
|
This function is useful for pulling a user or account name from an email address.
|
|
The following example turns `foo@example.com` into `foo`:
|
|
|
|
`{{truncateFrom .Account.Email "@"}}`
|
|
|
|
The example above uses the account email, but it could be any other parameter.
|
|
|
|
## Referenced By
|
|
|
|
- [Credential][]
|
|
- [Credential Store][]
|
|
- [Target][]
|
|
|
|
[credential store]: /boundary/docs/concepts/domain-model/credential-stores
|
|
[credential stores]: /boundary/docs/concepts/domain-model/credential-stores
|
|
[credential]: /boundary/docs/concepts/domain-model/credentials
|
|
[credentials]: /boundary/docs/concepts/domain-model/credentials
|
|
[project]: /boundary/docs/concepts/domain-model/scopes#projects
|
|
[projects]: /boundary/docs/concepts/domain-model/scopes#projects
|
|
[target]: /boundary/docs/concepts/domain-model/targets
|
|
[targets]: /boundary/docs/concepts/domain-model/targets
|
|
|
|
## Service API Docs
|
|
|
|
The following services are relevant to this resource:
|
|
|
|
- [Credential Library Service](/boundary/api-docs/credential-library-service)
|