Vault with Keycloak as workload IAM

What is Vault?

https://developer.hashicorp.com/vault/docs/about-vault/what-is-vault

Vault provides centralized, well-audited privileged access and secret management for mission-critical data whether you deploy systems on-premises, in the cloud, or in a hybrid environment.

With a modular design based around a growing plugin ecosystem, Vault lets you integrate with your existing systems and customize your application workflow.

Why should I use Vault?

Modern software works because of secrets. Secrets are sensitive, discrete pieces of information like credentials, encryption keys, authentication certificates, and other critical pieces of information your applications need to run consistently and securely.

Vault helps harden applications by centralizing secret management. With Vault you can:

• Manage static secrets
• Manage certificates
• Manage identities and authentication
• Manage 3rd-party secrets
• Manage sensitive data
• Support regulatory compliance

 

https://developer.hashicorp.com/vault/docs/auth

Auth methods

Auth methods are the components in Vault that perform authentication and are responsible for assigning identity and a set of policies to a user. In all cases, Vault will enforce authentication as part of the request processing. In most cases, Vault will delegate the authentication administration and decision to the relevant configured external auth method (e.g., Amazon Web Services, GitHub, Google Cloud Platform, Kubernetes, Microsoft Azure, Okta ...).

Having multiple auth methods enables you to use an auth method that makes the most sense for your use case of Vault and your organization.

To learn more about authentication, see the authentication concepts page.

 

Vault with Keycloak as workload IAM

https://github.com/fanqingsong/vault_on_keycloak_as_iam

Demonstrates how applications use Keycloak-issued JWTs to authenticate with HashiCorp Vault and securely access secrets using short-lived, least-privilege tokens.

This repository contains a runnable example in which an application:

1. authenticates to Keycloak with the OAuth 2.0 client credentials grant;
2. receives a signed access token representing its workload identity;
3. exchanges that JWT for a short-lived Vault token; and
4. reads only the KV secret allowed by its Vault policy.

This is a local development example. Its fixed passwords, HTTP endpoints, Vault dev mode, and embedded Keycloak client secret are intentionally unsuitable for production.

Trust flow

 

 

 

The Keycloak client secret is the bootstrap credential in this example. Keycloak's signature proves to Vault that the JWT was issued for that client. The Vault JWT role then maps that identity to the minimal demo-app policy.