Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of [DOCS] Updating approle docs and token partial to include batch token prefer… into release/1.14.x #26554

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions website/content/api-docs/auth/approle.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ include a-Z, 0-9, space, hyphen, underscore and periods.

```json
{
"token_type": "batch",
"token_ttl": "10m",
"token_max_ttl": "15m",
"token_policies": ["default"],
Expand Down
6 changes: 4 additions & 2 deletions website/content/docs/auth/approle.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,8 @@ The `approle` auth method allows machines or _apps_ to authenticate with
Vault-defined _roles_. The open design of `AppRole` enables a varied set of
workflows and configurations to handle large numbers of apps. This auth method
is oriented to automated workflows (machines and services), and is less useful
for human operators.
for human operators. We recommend using `batch` tokens with the
`AppRole` auth method.

An "AppRole" represents a set of Vault policies and login constraints that must
be met to receive a token with those policies. The scope can be as narrow or
Expand Down Expand Up @@ -91,6 +92,7 @@ management tool.

```shell-session
$ vault write auth/approle/role/my-role \
token_type=batch \
secret_id_ttl=10m \
token_num_uses=10 \
token_ttl=20m \
Expand Down Expand Up @@ -138,7 +140,7 @@ documentation.
$ curl \
--header "X-Vault-Token: ..." \
--request POST \
--data '{"policies": "dev-policy,test-policy"}' \
--data '{"policies": "dev-policy,test-policy", "token_type": "batch"}' \
http://127.0.0.1:8200/v1/auth/approle/role/my-role
```

Expand Down
3 changes: 2 additions & 1 deletion website/content/partials/tokenstorefields.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,5 @@
unless changed will be `service` tokens). For token store roles, there are two
additional possibilities: `default-service` and `default-batch` which specify
the type to return unless the client requests a different type at generation
time.
time. For machine based authentication cases, you should use `batch`
type tokens.
Loading