login-enforcement

Create a login enforcement

This endpoint creates or updates a login enforcement that specifies which MFA methods should be used when logging into Vault. If there are multiple login enforcements, each one needs to be satisfied before a login attempt succeeds.

Method	Path
POST	/identity/mfa/login-enforcement/:name

Parameters

• name (string: <required>) - Name for this login enforcement configuration.

• mfa_method_ids ([]string: <required>) - Array of MFA method UUIDs to use. These will be ORed together, meaning if several IDs are specified, any one of them is sufficient to login.

• auth_method_accessors ([]string: []) - Array of auth mount accessor IDs. If present, only auth methods corresponding to the given accessors are checked during login.

• auth_method_types ([]string: []) - Array of auth method types. If present, only auth methods corresponding to the given types are checked during login.

• identity_group_ids ([]string: []) - Array of identity group IDs. If present, only entities belonging to one of the given groups are checked during login. Note that these IDs can be from the current namespace or a child namespace.

• identity_entity_ids ([]string: []) - Array of identity entity IDs. If present, only entities with the given IDs are checked during login. Note that these IDs can be from the current namespace or a child namespace.

Note that while none of auth_method_accessors, auth_method_types, identity_group_ids, or identity_entity_ids is individually required, at least one of those four fields must be present to create a login enforcement.

Sample payload

{
  "mfa_method_ids": ["134f7ce9-feae-4c6c-9ed7-ab3e413dbfce"],
  "auth_method_accessors": ["auth_userpass_337fdb6a"]
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo

Read login enforcement

This endpoint reads the login enforcement configuration for a given name.

Method	Path
GET	/identity/mfa/login-enforcement/:name

Parameters

• name (string: <required>) – Name of the login enforcement.

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request GET \
    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo

Sample response

{
  "data": {
    "auth_method_accessors": [
      "auth_userpass_337fdb6a"
    ],
    "auth_method_types": [],
    "id": "24167a6c-759a-c596-6d48-391c89c4befc",
    "identity_entity_ids": [],
    "identity_group_ids": [],
    "mfa_method_ids": [
      "c1372abf-bf64-1f26-c2a4-cbcfa135b775"
    ],
    "name": "foo",
    "namespace_id": "root"
  }
}

Delete login enforcement

This endpoint deletes a login enforcement configuration by the given name.

Method	Path
DELETE	/identity/mfa/login-enforcement/:name

Parameters

• name (string: <required>) - Name of the login enforcement.

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo

List login enforcements

This endpoint lists login enforcements that are visible in the current namespace or in parent namespaces.

Method	Path
LIST	/identity/mfa/login-enforcement

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement

Sample response

{
  "data": {
    "keys": [
      "foo"
    ]
  }
}