Skip to main content

auth enable

The auth enable command enables an auth method at a given path. If an auth method already exists at the given path, an error is returned. After the auth method is enabled, it usually needs configuration. The configuration varies by auth method.

An auth method is responsible for authenticating users or machines and assigning them policies and a token with which they can access OpenBao. Authentication is usually mapped to policy. Please see the policies concepts page for more information.

Examples​

Enable the auth method "userpass" enabled at "userpass/":

$ bao auth enable userpass
Success! Enabled the userpass auth method at: userpass/

Create a user:

$ bao write auth/userpass/users/sethvargo password=secret
Success! Data written to: auth/userpass/users/sethvargo

For more information on the specific configuration options and paths, please see the auth method documentation.

Usage​

The following flags are available in addition to the standard set of flags included on all commands.

  • -audit-non-hmac-request-keys (string: "") - Key that will not be HMAC'd by audit devices in the request data object. Note that multiple keys may be specified by providing this option multiple times, each time with 1 key. An example of this is provided in the tune section.

  • -audit-non-hmac-response-keys (string: "") - Key that will not be HMAC'd by audit devices in the response data object. Note that multiple keys may be specified by providing this option multiple times, each time with 1 key.

  • -default-lease-ttl (duration: "") - The default lease TTL for this auth method. If unspecified, this defaults to the OpenBao server's globally configured default lease TTL, or a previously configured value for the auth method. Uses duration format strings.

  • -passthrough-request-headers (string: "") - request header values that will be sent to the auth method. Note that multiple keys may be specified by providing this option multiple times, each time with 1 key.

  • -allowed-response-headers (string: "") - response header values that the auth method will be allowed to set. Note that multiple keys may be specified by providing this option multiple times, each time with 1 key.

  • -description (string: "") - Human-friendly description for the purpose of this auth method.

  • -listing-visibility (string: "") - The flag to toggle whether to show the mount in the UI-specific listing endpoint. Valid values are "unauth" or "hidden", with the default "" being equivalent to "hidden".

  • -local (bool: false) - Mark the auth method as local-only. Local auth methods are not replicated nor removed by replication.

  • -max-lease-ttl (string: "") - The maximum lease duration, specified as a string duration like "5s" or "30m".

  • -path (string: "") - Place where the auth method will be accessible. This must be unique across all auth methods. This defaults to the "type" of the auth method. The auth method will be accessible at /auth/<path>.

  • -seal-wrap (bool: false) - Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability.

  • -token-type (string: "") - Specifies the type of tokens that should be returned by the auth method.

  • -plugin-version (string: "") - Configures the semantic version of the plugin to use. If unspecified, implies the built-in or any matching unversioned plugin that may have been registered.