Introduction
This article shows how to add `bound_claims` to a Vault role to restrict access into Vault via the OIDC auth method based on Azure Active Directory claims. Creating roles in Vault can restrict access when logging in with the OIDC auth method. This can be done via `bound_claims` within the Vault role. Possible restrictions when logging into Vault can be based on Azure AD groups, roles, emails, etc.
Procedure
- Enable and configure the OIDC auth method within Vault along with creating Vault role(s).
- (Optional) Create Vault external group(s) to associate with Azure AD.
- Gather the necessary claims from Azure AD to assign as a claim to the Vault role.
- Restrict access based on Azure AD Group.
- The claim will be `groups` and value will be the Object Id found from the overview page of the group in Azure AD.
- Restrict access based on Azure AD Group.
vault write auth/oidc/role/<VaultRole> -<<EOF
{
"bound_claims": {
"groups": ["<AADGroupObjectId"]
}
}
EOF
- Restrict access based on Azure AD App Roles.
- The claim will be `roles` and the value will be the “Vaule” of the Azure AD App Role.
vault write auth/oidc/role/<VaultRole> -<<EOF
{
"bound_claims": {
"roles": ["<AADAppRoleValue"]
}
}
EOF
- Restrict access based on specific Azure AD user emails
- The claim will be `email` based on the user’s email with access to the Azure AD web app.
vault write auth/oidc/role/<VaultRole> -<<EOF
{
"bound_claims": {
"groups": "<AADGroupObjectId>",
"email": [ "<email1>". "<email2>" ]
}
}
EOF
Testing claims returned from Azure
You can further test claims available when making the OIDC call from Vault into Azure. Note this is not recommended to be enabled within a production environment seeing sensitive information may be present in the OIDC responses.
- Enable verbose OIDC logging for individual Vault roles by running ` vault write auth/oidc/role/<VaultRole> verbose_oidc_logging="true"`
- When attempting to log into Vault via the OIDC method, Vault will log additional information and show the OIDC provider responses. This logging will include all claims provided from Azure AD. These claims can be added to the Vault role with `bound_claims` to then restrict access into Vault.
Additional Information