Dan HeathandRobin Beck
5ce6515156
* docs: IA reorganization * docs: Updates * docs: Updates * docs: Fix links * docs: Updates * docs: Fix a typo * docs: Fix client agent topic * docs: Update Client Agent nav * docs: Fix conflict * docs: Fix a typo in Client Agent docs (#5853) * docs: Fix client agent topic * docs: Updates * docs: Updates * docs: Updates * docs: Updates * docs: Fixes get started and operations links * docs: Update nav * docs: Partials * docs: Unix partials * docs: Worker partials * docs: Updates * docs: Update workers and targets * docs: Updates * docs: Updates * docs: Fixes link * docs: Updates after sync review * docs: Updates from review feedback * docs: Move worker filter examples * docs: Fix links * docs: Updates for filters based on working session * docs: Fixes broken links * docs: Add links to other filter topics * docs: Update list intro * docs: Adds link * docs: Fixes redirects * docs: Fixes redirects * docs: Deleted mysql page from TOC * docs: Add versioned redirect * docs: Adds versioned redirects * docs: Adds versioned redirects * docs: Update redirects * docs: Update redirects * docs: Redirect fixes * docs: Update redirect format * docs: Fix a typo * docs: Fixes redirects * docs: Fixes redirect * docs: Adds links out to client agent troubleshooting * uses /etc/boundary.d/ as recommended installation directory (#6003) * docs: Updates legacy io links * docs: Fixes redirects * docs: Fix redirect * docs: Restoring deleted file --------- Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
84 lines
2.5 KiB
Plaintext
84 lines
2.5 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Credential resource
|
|
description: >-
|
|
Learn about using the credential resource to define secrets for a host. Understand username password, SSH private key, SSH certificate, and JSON credential types.
|
|
---
|
|
|
|
# Credentials
|
|
|
|
A credential is a data structure containing one or more secrets that binds an identity to a set of permissions or capabilities on a [host][] for a [session][].
|
|
|
|
Optionally, credentials can be typed to indicate compliance with a specific format.
|
|
The following credential types are supported in Boundary:
|
|
|
|
- [Username password](#username-password)
|
|
- [SSH private key](#ssh-private-key)
|
|
- [SSH certificate](#ssh-certificate)
|
|
- [JSON](#json)
|
|
|
|
## Username password
|
|
|
|
`username_password` credentials contain the following fields:
|
|
|
|
- `username` - The username field associated with the credential.
|
|
|
|
- `password` - The password field associated with the credential.
|
|
|
|
## SSH private key
|
|
|
|
`ssh_private_key` credentials contain the following fields:
|
|
|
|
- `username` - The username field associated with the credential.
|
|
|
|
- `private_key` - The private key field associated with the credential.
|
|
|
|
## SSH certificate
|
|
|
|
`ssh_certificate` credentials contain the following fields:
|
|
|
|
- `username` - The username field associated with the credential.
|
|
|
|
- `ssh_certificate` - The SSH certificate associated with the credential.
|
|
|
|
## JSON
|
|
|
|
You can provide credentials using a JSON blob.
|
|
JSON credentials are only brokered to users that connect to machines.
|
|
There is no required structure for the JSON blob, other than it must be a key value map.
|
|
Refer to the example below:
|
|
|
|
<CodeBlockConfig heading="JSON credentials blob example">
|
|
|
|
```JSON
|
|
{
|
|
"type": "service_account",
|
|
"project_id": "",
|
|
"private_key_id": "",
|
|
"private_key": "-----BEGIN PRIVATE KEY----------END PRIVATE KEY-----\n",
|
|
"client_email": "",
|
|
"client_id": "",
|
|
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
|
|
"token_uri": "https://oauth2.googleapis.com/token",
|
|
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
|
|
"client_x509_cert_url": ""
|
|
}
|
|
```
|
|
|
|
</CodeBlockConfig>
|
|
|
|
## Referenced by
|
|
|
|
- [Credential store][]
|
|
- [Credential library][]
|
|
- [Session][]
|
|
- [Target][]
|
|
|
|
[credential library]: /boundary/docs/domain-model/credential-libraries
|
|
[credential libraries]: /boundary/docs/domain-model/credential-libraries
|
|
[credential store]: /boundary/docs/domain-model/credential-stores
|
|
[credential stores]: /boundary/docs/domain-model/credential-stores
|
|
[host]: /boundary/docs/domain-model/hosts
|
|
[session]: /boundary/docs/domain-model/sessions
|
|
[target]: /boundary/docs/domain-model/targets
|