Skip to main content

login

The login command authenticates users or machines to OpenBao using the provided arguments. A successful authentication results in an OpenBao token - conceptually similar to a session token on a website. By default, this token is cached on the local machine for future requests.

The -method flag allows using other auth methods, such as userpass, github, or cert. For these, additional "K=V" pairs may be required. For more information about the list of configuration parameters available for a given auth method, use the "bao auth help TYPE" command. You can also use "bao auth list" to see the list of enabled auth methods.

If an auth method is enabled at a non-standard path, the -method flag still refers to the canonical type, but the -path flag refers to the enabled path.

If the authentication is requested with response wrapping (via -wrap-ttl), the returned token is automatically unwrapped unless:

  • The -token-only flag is used, in which case this command will output the wrapping token.

  • The -no-store flag is used, in which case this command will output the details of the wrapping token.

Examples​

By default, login uses a "token" method and reads from stdin:

$ bao login
Token (will be hidden):
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "bao login"
again. Future OpenBao requests will automatically use this token.

Key                  Value
---                  -----
token                s.nDj4BB2tK8NaFffwBZBxyIa1
token_accessor       ZuaObqdTeCHZ4oa9HWmdQJuZ
token_duration       ∞
token_renewable      false
token_policies       ["root"]
identity_policies    []
policies             ["root"]

Alternatively, the token may be provided as a command line argument (note that this may be captured by shell history or process listings):

$ bao login s.3jnbMAKl1i4YS3QoKdbHzGXq
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "bao login"
again. Future OpenBao requests will automatically use this token.

Key                  Value
---                  -----
token                s.3jnbMAKl1i4YS3QoKdbHzGXq
token_accessor       7Uod1Rm0ejUAz77Oh7SxpAM0
token_duration       767h59m49s
token_renewable      true
token_policies       ["admin" "default"]
identity_policies    []
policies             ["admin" "default"]

To login with a different method, use -method:

$ bao login -method=userpass username=my-username
Password (will be hidden):
Success! You are now authenticated. The token information below is already
stored in the token helper. You do NOT need to run "bao login" again. Future
requests will use this token automatically.

Key                    Value
---                    -----
token                  s.2y4SU3Sk46dK3p2Y8q2jSBwL
token_accessor         8J125x9SZyB76MI9uF2jSJZf
token_duration         768h
token_renewable        true
token_policies         ["default"]
identity_policies      []
policies               ["default"]
token_meta_username    my-username
warning

Notice that the command option (-method=userpass) precedes the command argument (username=my-username).

If a github auth method was enabled at the path "github-prod":

$ bao login -method=github -path=github-prod
Success! You are now authenticated. The token information below is already
stored in the token helper. You do NOT need to run "bao login" again. Future
requests will use this token automatically.

Key                    Value
---                    -----
token                  s.2f3c5L1MHtnqbuNCbx90utmC
token_accessor         JLUIXJ6ltUftTt2UYRl2lTAC
token_duration         768h
token_renewable        true
token_policies         ["default"]
identity_policies      []
policies               ["default"]
token_meta_org         hashicorp
token_meta_username    my-username

Usage​

The following flags are available in addition to the standard set of flags included on all commands.

Output options​

  • -field (string: "") - Print only the field with the given name. Specifying this option will take precedence over other formatting directives. The result will not have a trailing newline making it ideal for piping to other processes.

  • -format (string: "table") - Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the BAO_FORMAT environment variable.

Command options​

  • -method (string "token") - Type of authentication to use such as "userpass" or "ldap". Note this corresponds to the TYPE, not the enabled path. Use -path to specify the path where the authentication is enabled.

  • -no-print (bool: false) - Do not display the token. The token will still be stored to the configured token helper. The default is false.

  • -no-store (bool: false) - Do not persist the token to the token helper (usually the local filesystem) after authentication for use in future requests. The token will only be displayed in the command output.

  • -path (string: "") - Remote path in OpenBao where the auth method is enabled. This defaults to the TYPE of method (e.g. userpass -> userpass/).

  • -token-only (bool: false) - Output only the token with no verification. This flag is a shortcut for "-field=token -no-store". Setting those flags to other values will have no affect.