Introduction
This article outlines the sequence of steps to set up TOTP MFA with userpass auth method.
Expected Outcome
Users should be prompted with a TOTP passcode from the issuer on logging in with userpass auth method
Prerequisites
- MFA is available only for Vault Enterprise customers
Use Case
To use TOTP as a two factor authentication method for userpass
Procedure
# Enable userpass auth method
vault auth enable userpass
# Write MFA method for TOTP with vault as the issuer
vault write sys/mfa/method/totp/my_totp issuer=Vault period=300 key_size=30 algorithm=SHA256 digits=6
# Create a policy with the needed permissions and associate it with the TOTP MFA method written above
vault policy write totp-policy -<<EOF
path "secret/foo" {
capabilities = ["read"]
mfa_methods = ["my_totp"]
}
EOF# Associate the policy created above with the userpass auth method
vault write auth/userpass/users/testuser password=testpassword policies=totp-policy
# login with the userpass auth method
vault write auth/userpass/login/testuser password=testpassword
# Do a token lookup from the token generated from the above command
vault token lookup <token generated from the above command>
# Generate a barcode or url to write a key using a third party key generator
vault write sys/mfa/method/totp/my_totp/admin-generate entity_id=<taken from the above command>
You can either use vault as generator of the key or any third party key generator. Once you have the key, you should be able to read the secrets.
To use Vault as Generator of the key, follow the instructions here
Note: MFA works only for tokens that have identity information on them. If you look at the token created by logging in with userpass auth method, you can see the associated identity information.