RDM Hashicorp Vault Domain Prefix/Suffix
Hi,
before I dive into my question I want to explain our current situation to provide a better understanding about our issue:
We use RDM RDP objects to connect to our Windows servers. The credentials are provided within each RDP object. We would like to get rid of these credentials in RDM and utilize our Hashicorp vault instead. So far so good. The problem is, that our vault structure does not include the domain suffix/prefix. Therefore, the login to a domain joined server won't work.
Our current test scenario:
RDP object with linked credentials to Hashicorp vault
The credential object in Hashicorp looks like:
- Path: XXXXX/CustomerID/ad (test.local)/Administrator/Administrator
As you can see, the user name itself does not contain any domain information. To make it work we would need to change the object to something like:
- Path: XXXXX/CustomerID/ad (test.local)/Administrator/Administrator@test.local
Is there another way to tell RDM to use a specific domain without modifying the Hashicorp vault object? Any additional attribute or something like that? We want to avoid adding the domain suffix to all Hashicorp credentials as we have dependencies on certain automations.
ede38e35-3f70-4791-ae0d-eb59c9fa4146.png
All Comments (5)
Hello,
Is this domain in your case stored in the Hashicorp object? Otherwise, where is it stored?
Regards,
Hubert Mireault
Hi,
the domain is stored within the path: XXXXX/CustomerID/ad (test.local)/Administrator/Administrator
Hello,
That would make it more difficult for us, especially since it's less applicable to other users who may use a different path structure.
We've done some investigation and it looks like you can add custom metadata to Hashicorp secrets:
For a new secret:
For an existing secret:
What we could do is have a new field in RDM to specify which metadata key holds the value for the domain (this is something we do for some of our other password integrations who don't directly support a domain).
Do you think it's a good solution for you, despite needing you to add this metadata field on your Hashicorp secrets? I'm not sure if Hashicorp offers scripting support to update this more easily.
Let me know what you think.
Regards,
Hubert Mireault
b3f91195-d959-4820-847a-8d9de14a3713.png
9b284282-7018-4699-bd53-ecfc13fab06e.png
Hi,
totally understand that our path structure is very unique and it would not make much sense to implement this into your product. Nevertheless, adding this information to the metadata instead looks like a good idea. I'll run a few tests and get back to you as soon as possible.
Apart from that, I would like to thank you for your super-fast support!
No problem, happy to help! Please let me know if storing this in the metadata is conclusive for you, and if it is, we will open a ticket to add support for this to RDM.
Regards,
Hubert Mireault