hashicorp / hashicorp/vault

Merge the Kerberos and LDAP authentication backends

Open
#32,049 1 comment 1 reaction 0 assignees View on GitHub
auth/kerberos auth/ldap enhancement
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

**Is your feature request related to a problem? Please describe.**
Looking at https://developer.hashicorp.com/vault/docs/auth/kerberos the Kerberos authentication backend is very similar to the regular LDAP backend. Maintaining two sets of rules that do more or less the same things are redundant and leaves the risk of possibly updating one set of rules but missing the other.

**Describe the solution you'd like**
I'd like the Kerberos authentication method to be merged into the LDAP authentication method such that a keytab can be used when authenticating with the LDAP backend. This could be configured for example under `auth/ldap/config/kerberos` separately from the regular ldap config.

**Describe alternatives you've considered**
Use terraform to mirror the LDAP and Kerberos configuration.

**Explain any additional use-cases**
This could reduce the maintenance burden having to maintain one less authentication method.

**Additional context**
N/A

Contributor guide

Open the contributing guide

Research direction

Start by comparing the Kerberos authentication backend at the linked Vault documentation page with the regular LDAP authentication backend. Trace how their configuration and authentication behavior are represented in the repository, then determine the scope needed for LDAP to accept a keytab through a separate Kerberos configuration. Done means the two backends no longer require duplicated rules while both authentication modes remain supported.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.