Vault Userpass auth method initial implementation by harshit-nema · Pull Request #2859 · hashicorp/terraform-provider-vault

harshit-nema · 2026-03-31T11:47:55Z

Description

The PR contains initial implementation of Vault Userpass auth method. It introduces :

vault_userpass_auth_backend_user for managing Userpass users (Creating/Deletion) along with policy and password update capabilities.
vault_userpass_auth_login as an ephemeral resource for authenticating with Userpass and using ephemeral token data during Terraform operations.

Checklist

Added CHANGELOG entry (only for user-facing changes)
Acceptance tests where run against all supported Vault Versions

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccXXX'
$TF_ACC=1 go test -v ./internal/vault/auth/userpass -run TestAccUserpassAuthBackendUser 
$TF_ACC=1 go test -v ./internal/vault/auth/userpass -run TestAccUserpassAuthLogin
...

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

Copilot

Pull request overview

Initial implementation of Vault’s Userpass auth method support in the Terraform Vault provider, adding management of Userpass users and an ephemeral login mechanism for short-lived tokens during Terraform operations.

Changes:

Added vault_userpass_auth_backend_user resource (create/delete user; manage token-related settings; support password updates including bcrypt hash in Vault 1.17+).
Added vault_userpass_auth_login ephemeral resource to authenticate via Userpass and expose token details without storing the token in state.
Registered the new resource/ephemeral resource with the framework provider and added acceptance tests + docs + changelog entry.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
website/docs/r/userpass_auth_backend_user.md	New docs for the Userpass user resource (examples, arguments, import)
website/docs/ephemeral-resources/userpass_auth_login.md	New docs for the Userpass login ephemeral resource
internal/vault/auth/userpass/user_resource.go	Implements the Userpass user resource using the Plugin Framework
internal/vault/auth/userpass/user_resource_test.go	Acceptance tests for the Userpass user resource
internal/vault/auth/userpass/login_ephemeral_resource.go	Implements the Userpass login ephemeral resource with token revocation on close
internal/vault/auth/userpass/login_ephemeral_resource_test.go	Acceptance tests for the login ephemeral resource
internal/provider/fwprovider/provider.go	Registers the new resource + ephemeral resource
internal/consts/consts.go	Adds the `password_hash_wo` field constant
CHANGELOG.md	Adds a feature entry for Userpass auth support

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

sanvikam79 · 2026-04-10T12:32:21Z

+		statecheck.ExpectKnownValue(
+			"echo.test_userpass",
+			tfjsonpath.New("data").AtMapKey(consts.FieldPolicies),
+			knownvalue.NotNull(),


Instead of only checking that is non-null, can we verify the actual expected value here?
check in all places where policies used for the same

Setting the expected value check in Policy field. Other fields where values are obtained in the response from vault end like 'renewable' and 'lease_duration', better not provide value check, as if there is any change in default values, these test cases will fail in future.

tejashwiniingalagi · 2026-04-17T05:25:24Z

+	}
+
+	// Read version fields from config to ensure they're stored in state
+	var configData UserpassAuthUserModel


this seems be to duplicate with line 137. Could you remove either of one

Code is refactored. Placing common code in helper function.

tejashwiniingalagi · 2026-04-17T05:29:38Z

+	})
+}
+
+func TestAccUserpassAuthBackendUser_passwordWOVersion(t *testing.T) {


Do we also need a test to verify behavior when password changes without incrementing version counter.

Added test to verify the behaviour when password changes without version increment.

siyer-corp · 2026-04-17T06:21:27Z

+
+var userRegexp = regexp.MustCompile(`^auth/(.+)/users/(.+)$`)
+var bcryptHashRegexp = regexp.MustCompile(`^\$2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}$`)
+


Can we check how this is handled in Vault side?

Validation check as present in Vault side implemented.

siyer-corp · 2026-04-17T06:27:35Z

+}
+
+// updatePasswordAndPoliciesEndpoints writes legacy compatibility endpoints when needed.
+func (r *UserpassAuthUserResource) updatePasswordAndPoliciesEndpoints(ctx context.Context, vaultClient *api.Client, data *UserpassAuthUserModel, password, passwordHash string) error {


Is there a reason why password and poilcy updates are handled in the user resource? It looks like these are calling different endpoints.

Password and policy updates are still part of the Userpass user lifecycle, so handling them in the user resource looks to be the appropriate design.

We are calling a sub-path in the API endpoint, not the one that Update calls. The password on the user resource should probably be Create Only if that's how it's designed in vault. And the user will need to use the sub-path to udpate the password.

Redudant sub-endponits call removed.

…lias_metadata

…ionIncrement, code refactoring

harshit-nema requested review from Balaji2198, sanvikam79, siyer-corp and vijayavelsekar March 31, 2026 11:47

harshit-nema requested review from a team as code owners March 31, 2026 11:47

harshit-nema force-pushed the VAULT-43413-Userpass-Initial-Implementation branch from 93a078b to d578f6f Compare March 31, 2026 12:20