Kerberos auth method initial implementation of resources and ephemeral resources by vijayavelsekar · Pull Request #2819 · hashicorp/terraform-provider-vault

vijayavelsekar · 2026-03-11T07:43:02Z

Description

Initial implementation for below resources and ephemeral resource.

vault_kerberos_auth_backend_config (Resource)
vault_kerberos_auth_backend_ldap_config (Resource)
vault_kerberos_auth_backend_group (Resource)
vault_kerberos_auth_backend_login (Ephemeral Resource)

Note:-
This PR updates the TestDataSourceAuthBackends acceptance test because it runs concurrently with Kerberos test cases. During concurrent execution, the auth backends created by the Kerberos tests conflict with those used by the data source auth backend tests. To avoid this conflict, the TestDataSourceAuthBackends test has been updated to validate only the backends that it explicitly creates.

Closes #1723

Checklist

Added CHANGELOG entry (only for user-facing changes)
Acceptance tests where run against all supported Vault Versions

Output from acceptance testing:

go test -v ./internal/vault/auth/kerberos -run="TestAccKerberosAuthBackendConfig|TestAccKerberosAuthBackendLDAPConfig|TestAccKerberosAuthBackendGroup" -count=1
=== RUN   TestAccKerberosAuthBackendConfig_basic
--- PASS: TestAccKerberosAuthBackendConfig_basic (1.32s)
=== RUN   TestAccKerberosAuthBackendConfig_update
--- PASS: TestAccKerberosAuthBackendConfig_update (1.99s)
=== RUN   TestAccKerberosAuthBackendConfig_keytabUpdate
--- PASS: TestAccKerberosAuthBackendConfig_keytabUpdate (1.93s)
=== RUN   TestAccKerberosAuthBackendConfig_import
--- PASS: TestAccKerberosAuthBackendConfig_import (1.41s)
=== RUN   TestAccKerberosAuthBackendConfig_defaultCheck
--- PASS: TestAccKerberosAuthBackendConfig_defaultCheck (1.15s)
=== RUN   TestAccKerberosAuthBackendConfig_pathChange
--- PASS: TestAccKerberosAuthBackendConfig_pathChange (3.11s)
=== RUN   TestAccKerberosAuthBackendConfig_validationErrors
--- PASS: TestAccKerberosAuthBackendConfig_validationErrors (1.20s)
=== RUN   TestAccKerberosAuthBackendConfig_runtimeErrors
--- PASS: TestAccKerberosAuthBackendConfig_runtimeErrors (0.97s)
=== RUN   TestAccKerberosAuthBackendConfig_importErrors
--- PASS: TestAccKerberosAuthBackendConfig_importErrors (0.71s)
=== RUN   TestAccKerberosAuthBackendConfig_namespace
--- PASS: TestAccKerberosAuthBackendConfig_namespace (2.52s)
=== RUN   TestAccKerberosAuthBackendConfig_importWithNamespace
--- PASS: TestAccKerberosAuthBackendConfig_importWithNamespace (2.97s)
=== RUN   TestAccKerberosAuthBackendGroup_basic
--- PASS: TestAccKerberosAuthBackendGroup_basic (2.53s)
=== RUN   TestAccKerberosAuthBackendGroup_defaultCheck
--- PASS: TestAccKerberosAuthBackendGroup_defaultCheck (1.17s)
=== RUN   TestAccKerberosAuthBackendGroup_pathChange
--- PASS: TestAccKerberosAuthBackendGroup_pathChange (3.44s)
=== RUN   TestAccKerberosAuthBackendGroup_nameChange
--- PASS: TestAccKerberosAuthBackendGroup_nameChange (2.61s)
=== RUN   TestAccKerberosAuthBackendGroup_noPolicies
--- PASS: TestAccKerberosAuthBackendGroup_noPolicies (1.41s)
=== RUN   TestAccKerberosAuthBackendGroup_namespace
--- PASS: TestAccKerberosAuthBackendGroup_namespace (3.10s)
=== RUN   TestAccKerberosAuthBackendGroup_invalid
--- PASS: TestAccKerberosAuthBackendGroup_invalid (0.57s)
=== RUN   TestAccKerberosAuthBackendGroup_invalidNamespace
--- PASS: TestAccKerberosAuthBackendGroup_invalidNamespace (0.88s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_basic
--- PASS: TestAccKerberosAuthBackendLDAPConfig_basic (1.31s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_update
--- PASS: TestAccKerberosAuthBackendLDAPConfig_update (2.14s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_bindPassUpdate
--- PASS: TestAccKerberosAuthBackendLDAPConfig_bindPassUpdate (2.33s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_import
--- PASS: TestAccKerberosAuthBackendLDAPConfig_import (1.59s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_defaultCheck
--- PASS: TestAccKerberosAuthBackendLDAPConfig_defaultCheck (1.23s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_pathChange
--- PASS: TestAccKerberosAuthBackendLDAPConfig_pathChange (3.36s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_validationErrors
--- PASS: TestAccKerberosAuthBackendLDAPConfig_validationErrors (0.32s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_runtimeErrors
--- PASS: TestAccKerberosAuthBackendLDAPConfig_runtimeErrors (0.38s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_batchTokenWithNumUses
--- PASS: TestAccKerberosAuthBackendLDAPConfig_batchTokenWithNumUses (0.64s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_configNotFound
--- PASS: TestAccKerberosAuthBackendLDAPConfig_configNotFound (1.77s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_importErrors
--- PASS: TestAccKerberosAuthBackendLDAPConfig_importErrors (0.75s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_allFields
--- PASS: TestAccKerberosAuthBackendLDAPConfig_allFields (1.15s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_aliasMetadata
    kerberos_ldap_config_resource_test.go:464: Vault server version "1.21.0+ent"
--- PASS: TestAccKerberosAuthBackendLDAPConfig_aliasMetadata (2.21s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_enableSAMAccountNameLogin
    kerberos_ldap_config_resource_test.go:502: Vault server version "1.21.0+ent"
--- PASS: TestAccKerberosAuthBackendLDAPConfig_enableSAMAccountNameLogin (2.41s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_namespace
--- PASS: TestAccKerberosAuthBackendLDAPConfig_namespace (2.80s)
=== RUN   TestAccKerberosAuthBackendLDAPConfig_importWithNamespace
--- PASS: TestAccKerberosAuthBackendLDAPConfig_importWithNamespace (3.22s)
PASS
ok      github.com/hashicorp/terraform-provider-vault/internal/vault/auth/kerberos      63.278s

go test -v ./internal/vault/auth/ephemeral -run TestAccKerberosAuthBackendLoginEphemeralResource -count=1
=== RUN   TestAccKerberosAuthBackendLoginEphemeralResource_basic
    kerberos_login_test.go:57: Vault server version "1.21.0+ent"
--- PASS: TestAccKerberosAuthBackendLoginEphemeralResource_basic (3.47s)
=== RUN   TestAccKerberosAuthBackendLoginEphemeralResource_withOptions
    kerberos_login_test.go:181: Vault server version "1.21.0+ent"
--- PASS: TestAccKerberosAuthBackendLoginEphemeralResource_withOptions (3.31s)
=== RUN   TestAccKerberosAuthBackendLoginEphemeralResource_namespace
    kerberos_login_test.go:286: Vault server version "1.21.0+ent"
--- PASS: TestAccKerberosAuthBackendLoginEphemeralResource_namespace (4.17s)
PASS
ok      github.com/hashicorp/terraform-provider-vault/internal/vault/auth/ephemeral     12.412s

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

harshit-nema

Review comments for config_resource.

harshit-nema

Sharing few review comments for kerberos_ldap_config_resource.

Copilot

Pull request overview

Adds initial Terraform Plugin Framework support for Vault’s Kerberos auth method, including 3 new managed resources (backend config, LDAP config, group mappings) and 1 new ephemeral resource for Kerberos login/token issuance, plus accompanying docs and acceptance tests.

Changes:

Introduce Kerberos auth resources: vault_kerberos_auth_backend_config, vault_kerberos_auth_backend_ldap_config, vault_kerberos_auth_backend_group.
Add Kerberos login ephemeral resource: vault_kerberos_auth_backend_login (revokes token on close).
Add new docs + acceptance tests, and adjust vault_auth_backends data source test to avoid concurrent backend conflicts.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
website/docs/r/kerberos_auth_backend_ldap_config.html.md	New resource docs for Kerberos LDAP configuration, including token fields and import instructions.
website/docs/r/kerberos_auth_backend_group.html.md	New resource docs for mapping LDAP groups to Vault policies under Kerberos auth.
website/docs/r/kerberos_auth_backend_config.html.md	New resource docs for configuring Kerberos backend (keytab/service account).
website/docs/ephemeral-resources/kerberos_auth_backend_login.html.md	New ephemeral resource docs for Kerberos login and ephemeral token usage.
vault/data_source_auth_backends_test.go	Updates acceptance test assertions to avoid conflicts with concurrently-created Kerberos backends.
testutil/testutil.go	Adds helper + struct for skipping Kerberos tests unless required env vars are present.
internal/vault/auth/kerberos/kerberos_ldap_config_resource_test.go	Adds acceptance test coverage for Kerberos LDAP config resource (defaults, updates, import, namespace, etc.).
internal/vault/auth/kerberos/kerberos_ldap_config_resource.go	Implements Kerberos LDAP config resource using the Plugin Framework + token field helpers.
internal/vault/auth/kerberos/kerberos_group_resource_test.go	Adds acceptance tests for Kerberos group resource behavior (CRUD/import/namespace/errors).
internal/vault/auth/kerberos/kerberos_group_resource.go	Implements Kerberos group mapping resource (policies for LDAP groups).
internal/vault/auth/kerberos/kerberos_config_resource_test.go	Adds acceptance tests for Kerberos backend config resource (CRUD/import/defaults/errors/namespace).
internal/vault/auth/kerberos/kerberos_config_resource.go	Implements Kerberos backend config resource (write-only keytab, service account, options).
internal/vault/auth/ephemeral/kerberos_login_test.go	Adds acceptance tests for Kerberos login ephemeral resource (basic/options/namespace).
internal/vault/auth/ephemeral/kerberos_login.go	Implements Kerberos login ephemeral resource (SPNEGO auth header + token revocation on Close).
internal/provider/fwprovider/provider.go	Registers the new Kerberos resources and ephemeral resource with the framework provider.
internal/consts/consts.go	Adds missing consts used by Kerberos resources/ephemeral outputs (e.g., identity_policies, keytab, client TLS WO fields).
CHANGELOG.md	Adds changelog entry for the new Kerberos resources and ephemeral login.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

harshit-nema

Review comments for kerberos_group_resource

harshit-nema

Ephemeral resource : Kerberos_login review.
Also will there be any modifications required for vault.erb file for this new implementation on Vault Kerberos auth method

hashicorp-cla-app · 2026-03-18T14:28:41Z

All committers have signed the CLA.

siyer-corp

Provided some comments on the first pass. For the ldap_config_resource, can we check if the functionality is similar to ldap_auth resource?

siyer-corp

As discussed, let's check if changes in vault/data_source_auth_backends_test.go are required. Provided some additional comments.

siyer-corp

As discussed, can we refactor the tests accordingly?

siyer-corp · 2026-03-25T11:22:40Z

+			},
+			consts.FieldEnableSamaccountnameLogin: schema.BoolAttribute{
+				Optional:    true,
+				Description: "If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. **Note:** This field is only supported in Vault 1.19.0 and above. Do not configure this attribute if your Vault version is below 1.19.0.",


Can we make this consise? We can update the note to say "Requires Vault 1.19.0+"

siyer-corp · 2026-03-25T11:23:38Z

+				Optional:    true,
+				WriteOnly:   true,
+				Sensitive:   true,
+				Description: "Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.",


Can we split these into multi-line for better readability?

siyer-corp · 2026-03-25T11:32:30Z

+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ephemeralauth


Can we move these two files inside the kerberos directory?

siyer-corp · 2026-03-25T11:35:58Z

+}
+
+// TestAccKerberosAuthBackendConfig_runtimeErrors tests runtime errors
+func TestAccKerberosAuthBackendConfig_runtimeErrors(t *testing.T) {


Do we need this as it's testing vault functionality, not TFVP?

siyer-corp · 2026-03-25T11:37:25Z

+}
+
+// TestAccKerberosAuthBackendLDAPConfig_runtimeErrors tests runtime errors
+func TestAccKerberosAuthBackendLDAPConfig_runtimeErrors(t *testing.T) {


Do we need this as it's testing vault functionality, not TFVP?

siyer-corp · 2026-03-25T11:40:05Z

+	})
+}
+
+func TestAccKerberosAuthBackendGroup_invalid(t *testing.T) {


Do we need this as it's testing vault functionality, not TFVP?

…d_config resource

…_config resource

…mentation and test fix

…ementation

…ecuting test cases

…urce

…cases

…ivate data

… to enable zero value update in statefile

…rent standard pattern

…ab and removed unwanted tests

vijayavelsekar changed the title ~~Vault 42404 kerberos auth method implementation~~ Kerberos auth method initial implementation of resources and ephemeral resources Mar 11, 2026

vijayavelsekar marked this pull request as ready for review March 11, 2026 14:49

vijayavelsekar requested review from a team as code owners March 11, 2026 14:49

vijayavelsekar requested review from harshit-nema and vidparmar March 11, 2026 14:49

harshit-nema reviewed Mar 12, 2026

View reviewed changes

harshit-nema requested a review from Copilot March 12, 2026 18:46

Copilot started reviewing on behalf of harshit-nema March 12, 2026 18:47 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

vijayavelsekar added this to the 5.9.0 milestone Mar 13, 2026

vijayavelsekar force-pushed the VAULT-42404-Kerberos-Auth-Method-Implementation branch from ddd802e to 84b9313 Compare March 13, 2026 07:41

vijayavelsekar requested a review from harshit-nema March 13, 2026 15:34

harshit-nema reviewed Mar 17, 2026

View reviewed changes

siyer-corp reviewed Mar 20, 2026

View reviewed changes

siyer-corp reviewed Mar 22, 2026

View reviewed changes

vijayavelsekar requested review from harshit-nema and siyer-corp March 23, 2026 15:12

harshit-nema reviewed Mar 27, 2026

View reviewed changes

Comment thread website/docs/r/kerberos_auth_backend_ldap_config.html.md

siyer-corp reviewed Mar 27, 2026

View reviewed changes

vijayavelsekar force-pushed the VAULT-42404-Kerberos-Auth-Method-Implementation branch 2 times, most recently from b9ccbe1 to 9c79a2d Compare March 31, 2026 11:14

vijayavelsekar requested a review from siyer-corp March 31, 2026 14:17

vijayavelsekar added 4 commits April 7, 2026 16:00

VAULT-42404 vault_kerberos_auth_backend_config resource implementation

bd7afb9

VAULT-42404 Added additional test case for vault_kerberos_auth_backen…

f1fe0ad

…d_config resource

VAULT-42404 Bug fixes for vault_kerberos_auth_backend_config resource

ef973fa

VAULT-42404 path to mount refactoring for vault_kerberos_auth_backend…

5b8aa60

…_config resource

vijayavelsekar and others added 27 commits April 7, 2026 16:00

VAULT-42404 vault_kerberos_auth_backend_login ephemeral resource docu…

18672a3

…mentation and test fix

VAULT-42404 vault_kerberos_auth_backend_login ephermal namespace impl…

2515763

…ementation

VAULT-42404 Removed unwanted ephemeral comment

519c578

VAULT-42404 Duplicate constant removal

481310f

VAULT-42404 Change log update

bef697a

VAULT-42404 Parallel test execution bug fix

5e7ba1b

VAULT-42404 Fix for auth method interferance by other concurrently ex…

02358fe

…ecuting test cases

VAULT-42404 Addressed review comment changes

cf6fc95

VAULT-42404 Change log update due to last release

0c70a60

VAULT-42404 Simplification of vault_kerberos_auth_backend_config reso…

5d38068

…urce

VAULT-42404 Optimization for vault_kerberos_auth_backend_group resource

9c82a73

VAULT-42404 Removed unnecessary comment

871b619

VAULT-42404 Addressing review comments for kerberos ldap config test …

d41b98a

…cases

VAULT-42404 Addressing review comments

62c09bc

VAULT-42404 Fixing copilot comment on close method safe exit on no pr…

dd20037

…ivate data

VAULT-42404 Addressed review comments

c702d34

VAULT-42404 Addressing review comments

6ae6894

VAULT-42404 Addressing review comments

d7f449b

VAULT-42404 Additional test cases as per the review comments

54fdb01

VAULT-42404 Addressing review comments

337cb77

VAULT-42404 Addressing review comments and Token field design bug fix…

6f904f7

… to enable zero value update in statefile

VAULT-42404 Moving ephemeral resources to ephemeral folder as per cur…

faa80cc

…rent standard pattern

VAULT-42404 Addressing review comments

caaaf27

VAULT-42404 Md file review comment fix

3249343

VAULT-42404 addressing review comments

d5af1e9

VAULT-42404 Addressing review comment

0f9c828

VAULT-43852 Added write-only field and updated related files for keyt…

108b7fc

…ab and removed unwanted tests

vijayavelsekar force-pushed the VAULT-42404-Kerberos-Auth-Method-Implementation branch from 161070d to 108b7fc Compare April 7, 2026 10:31

vijayavelsekar modified the milestones: 5.9.0, 5.10.0 Apr 17, 2026

Conversation

vijayavelsekar commented Mar 11, 2026 • edited by siyer-corp Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Output from acceptance testing:

Community Note

PCI review checklist

Uh oh!

harshit-nema left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harshit-nema left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harshit-nema left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harshit-nema left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hashicorp-cla-app Bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

siyer-corp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vijayavelsekar commented Mar 11, 2026 •

edited by siyer-corp

Loading

hashicorp-cla-app Bot commented Mar 18, 2026 •

edited

Loading