1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["1098"],{57950(e,t,n){n.r(t),n.d(t,{metadata:()=>i,default:()=>h,frontMatter:()=>r,contentTitle:()=>o,toc:()=>c,assets:()=>d});var i=JSON.parse('{"id":"secrets/identity/index","title":"Identity secrets engine","description":"The Identity secrets engine for OpenBao manages client identities.","source":"@site/versioned_docs/version-2.6.x/secrets/identity/index.mdx","sourceDirName":"secrets/identity","slug":"/secrets/identity/","permalink":"/docs/2.6.x/secrets/identity/","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/release/2.6.x/website/content/docs/secrets/identity/index.mdx","tags":[],"version":"2.6.x","frontMatter":{"sidebar_label":"Overview","description":"The Identity secrets engine for OpenBao manages client identities."},"sidebar":"docs","previous":{"title":"Valkey","permalink":"/docs/2.6.x/secrets/databases/valkey"},"next":{"title":"Identity tokens","permalink":"/docs/2.6.x/secrets/identity/identity-token"}}'),s=n(94686),a=n(44812);let r={sidebar_label:"Overview",description:"The Identity secrets engine for OpenBao manages client identities."},o="Identity secrets engine",d={},c=[{value:"API",id:"api",level:2}];function l(e){let t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,a.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"identity-secrets-engine",children:"Identity secrets engine"})}),"\n",(0,s.jsxs)(t.p,{children:["Name: ",(0,s.jsx)(t.code,{children:"identity"})]}),"\n",(0,s.jsxs)(t.p,{children:["The Identity secrets engine is the identity management solution for OpenBao. It\ninternally maintains the clients who are recognized by OpenBao. Each client is\ninternally termed as an ",(0,s.jsx)(t.code,{children:"Entity"}),". An entity can have multiple ",(0,s.jsx)(t.code,{children:"Aliases"}),". For\nexample, a single user who has accounts in both GitHub and LDAP, can be mapped\nto a single entity in OpenBao that has 2 aliases, one of type GitHub and one of\ntype LDAP. When a client authenticates via any of the credential backends\n(except the Token backend), OpenBao creates a new entity and attaches a new\nalias to it, if a corresponding entity doesn't already exist. The entity identifier will\nbe tied to the authenticated token. When such tokens are put to use, their\nentity identifiers are audit logged, marking a trail of actions performed by\nspecific users."]}),"\n",(0,s.jsxs)(t.p,{children:["Identity store allows operators to ",(0,s.jsx)(t.strong,{children:"manage"})," the entities in OpenBao. Entities\ncan be created and aliases can be tied to entities, via the ACL'd API. There\ncan be policies set on the entities which adds capabilities to the tokens that\nare tied to entity identifiers. The capabilities granted to tokens via the\nentities are ",(0,s.jsx)(t.strong,{children:"an addition"})," to the existing capabilities of the token and\n",(0,s.jsx)(t.strong,{children:"not"})," a replacement. The capabilities of the token that get inherited from\nentities are computed dynamically at request time. This provides flexibility in\ncontrolling the access of tokens that are already issued."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.strong,{children:"NOTE:"})," This secrets engine will be mounted by default. This secrets engine\ncannot be disabled or moved. For more conceptual overview on identity, refer to\nthe ",(0,s.jsx)(t.a,{href:"/docs/2.6.x/concepts/identity",children:"Identity"})," documentation."]})}),"\n",(0,s.jsx)(t.p,{children:"The OpenBao Identity secrets engine supports several different features. Each\none is individually documented on its own page."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"/docs/2.6.x/secrets/identity/identity-token",children:"Identity tokens"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"/docs/2.6.x/secrets/identity/oidc-provider",children:"OIDC Identity Provider"})}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"api",children:"API"}),"\n",(0,s.jsxs)(t.p,{children:["The Identity secrets engine has a full HTTP API. Please see the\n",(0,s.jsx)(t.a,{href:"/docs/2.6.x/api/secret/identity/",children:"Identity secrets engine API"})," for more\ndetails."]}),"\n",(0,s.jsxs)(t.p,{children:["Additionally, OpenBao can be configured as an OIDC i
1dentity provider. Please see\nthe ",(0,s.jsx)(t.a,{href:"/docs/2.6.x/api/secret/identity/oidc-provider",children:"OIDC identity provider API"})," for\nmore details."]})]})}function h(e={}){let{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},44812(e,t,n){n.d(t,{R:()=>r,x:()=>o});var i=n(92990);let s={},a=i.createContext(s);function r(e){let t=i.useContext(a);return i.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.