You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/content/docs/commands/credentials/create.mdx
+44-2Lines changed: 44 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
layout: docs
3
3
page_title: credentials create - Command
4
4
description: >-
5
-
The "credentials create" command creates new credential resources. You can create JSON, SSH privatekey, and username-password credentials.
5
+
The "credentials create" command creates new credential resources. Available types are json, ssh-private-key, username-password, and username-password-domain.
6
6
---
7
7
8
8
# credentials create
@@ -76,7 +76,7 @@ You can also specify the credential store using the **BOUNDARY_CREDENTIAL_STORE_
76
76
77
77
#### Usages by type
78
78
79
-
The available types are `json`, `ssh-private-key`, and `username-password`.
79
+
The available types are `json`, `ssh-private-key`, `username-password`, and `username-password-domain`.
80
80
81
81
<Tabs>
82
82
<Tabheading="JSON">
@@ -199,6 +199,48 @@ The following options are specific to username password credentials in addition
199
199
This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value.
200
200
-`-username``(string: "")` - The username associated with the credential.
201
201
202
+
</Tab>
203
+
<Tabheading="Username password domain">
204
+
205
+
The `credentials create username-password-domain` command lets you create a username password domain credential type for Active Directory authentication.
206
+
207
+
Username password domain credentials are primarily used with RDP targets for credential injection.
208
+
209
+
#### Example
210
+
211
+
The following example creates a username password domain credential in a credential store with the ID `csst_1234567890`:
The following options are specific to username password domain credentials in addition to the command options:
234
+
235
+
-`domain``(string: "")` - The Active Directory domain name. If you include the domain in the `username` field, Boundary automatically fills in the domain information.
236
+
237
+
For example, if you enter `admin@mydomain` or `mydomain\admin` in the `username` field, Boundary automatically completes the `domain` field with `mydomain`.
238
+
239
+
-`password``(string: "")` - The password associated with the credential. This value can be a reference to a file on disk (file://) or an environment variable (env://) from which Boundary reads the value.
240
+
241
+
-`username``(string: "")` - The username associated with the credential. This value can include domain information in `username@domain` or `domain\username` format.
The following options are specific to username password domain credentials in addition to the command options:
235
+
236
+
-`domain``(string: "")` - The Active Directory domain name. If you include the domain in the `username` field, Boundary automatically fills in the domain information.
237
+
238
+
For example, if you enter `admin@mydomain` or `mydomain\admin` in the `username` field, Boundary automatically completes the `domain` field with `mydomain`.
239
+
240
+
-`password``(string: "")` - The password associated with the credential. This value can be a reference to a file on disk (file://) or an environment variable (env://) from which Boundary reads the value.
241
+
242
+
-`username``(string: "")` - The username associated with the credential. This value can include domain information in `username@domain` or `domain\username` format.
-`-address=<string>` - An optional valid network address for the target to connect to.
69
+
You cannot use an address alongside host sources.
70
+
71
+
If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address.
72
+
-`-default-client-port=<string>` - The default client port on the target.
73
+
-`-default-port=<string>` - The default port on the target.
74
+
Due to a port conflict on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions cannot use the default RDP port `3389`.
75
+
You must configure a custom port to use transparent sessions with RDP targets.
76
+
77
+
Refer to [Using transparent sessions with RDP on Windows](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix#using-transparent-sessions-with-rdp-on-windows) for more information about configuring a custom port for transparent sessions.
78
+
-`-egress-worker-filter=<string>` - A Boolean expression that filters which egress workers can process sessions for the target.
79
+
-`-ingress-worker-filter=<string>` - A Boolean expression that filters which ingress workers can process sessions for the target.
80
+
-`-session-connection-limit=<string>` - The maximum number of connections allowed for a session.
81
+
A value of `-1` means the connections are unlimited.
82
+
-`-session-max-seconds=<string>` - The maximum lifetime of the session, including all connections.
83
+
You can specify an integer number of seconds or a duration string.
84
+
If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds).
85
+
-`-with-alias-authorize-session-host-id=<string>` - The host ID that an alias uses to authorize sessions for the target.
86
+
-`-with-alias-scope-id=<string>` - The scope ID that you want to create the target and alias in.
87
+
The default is `global`.
88
+
At this time, aliases are only supported for the global scope.
89
+
-`-with-alias-value=<string>` - The value of the alias that you want to use to represent the target.
90
+
Use this parameter to create the alias and target, and associate them with each other, at the same time.
91
+
92
+
93
+
</Tab>
43
94
<Tabheading="SSH">
44
95
45
96
The `targets create ssh` command lets you create SSH targets.
@@ -133,4 +184,4 @@ Use this parameter to create the alias and target, and associate them with each
-`-address=<string>` - An optional valid network address for the target to connect to.
69
+
You cannot use an address alongside host sources.
70
+
71
+
If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address.
72
+
-`-default-client-port=<string>` - The default client port on the target.
73
+
-`-default-port=<string>` - The default port on the target.
74
+
Due to a port conflict on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions cannot use the default RDP port `3389`.
75
+
You must configure a custom port to use transparent sessions with RDP targets.
76
+
77
+
Refer to [Using transparent sessions with RDP on Windows](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix#using-transparent-sessions-with-rdp-on-windows) for more information about configuring a custom port for transparent sessions.
78
+
-`-egress-worker-filter=<string>` - A Boolean expression that filters which egress workers can process sessions for the target.
79
+
-`-ingress-worker-filter=<string>` - A Boolean expression that filters which ingress workers can process sessions for the target.
80
+
-`-session-connection-limit=<string>` - The maximum number of connections allowed for a session.
81
+
A value of `-1` means the connections are unlimited.
82
+
-`-session-max-seconds=<string>` - The maximum lifetime of the session, including all connections.
83
+
You can specify an integer number of seconds or a duration string.
84
+
If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds).
85
+
86
+
</Tab>
43
87
<Tabheading="SSH">
44
88
45
89
The `targets update ssh` command lets you update SSH targets.
Copy file name to clipboardExpand all lines: website/content/docs/concepts/credential-management.mdx
+19-4Lines changed: 19 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,8 +33,8 @@ The credential brokering process works as follows:
33
33
34
34
The user is authenticated to the target.
35
35
36
-
You can attach brokered credentials to either TCP targets or SSH targets.
37
-
Brokered credentials can take the form of a token, username and password, SSH private key, certificate, JSON blob, or an unstructured secret stored in Vault, for example.
36
+
You can attach brokered credentials to SSH, TCP, or RDP targets.
37
+
Brokered credentials can take the form of a token, username password, username password domain, JSON blob, or an unstructured secret stored in Vault, for example.
38
38
39
39
### Security considerations
40
40
@@ -87,7 +87,18 @@ The credential injection process works as follows:
87
87
Then the controller passes credentials to the worker.
88
88
The worker authenticates to the target, and the user is then authenticated to the target.
89
89
90
-
Credential injection is required for the SSH target type, allowing users to inject the following credential types when they access targets using SSH:
90
+
### Target types
91
+
92
+
Credential injection is required for the RDP and SSH target types.
93
+
94
+
<Note>
95
+
96
+
RDP credential injection is currently in beta.
97
+
For more information about known issues, configuration requirements, and compatibility with Windows, refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix).
98
+
99
+
</Note>
100
+
101
+
You can inject the following credential types when you access SSH targets:
91
102
92
103
- SSH certificates
93
104
- Usernames and passwords
@@ -96,7 +107,9 @@ Credential injection is required for the SSH target type, allowing users to inje
96
107
Keyboard-interactive authentication is not supported for credential injection.
97
108
When you use Username password credentials, ensure that your SSH server is configured to allow password authentication.
98
109
99
-
You can broker additional credentials to SSH targets after the session is established using injected credentials.
110
+
You can inject username password domain credentials when you access RDP targets in Windows environments that use Active Directory or NTLMv2 for authentication.
111
+
112
+
You can broker additional credentials to RDP or SSH targets after the session is established using injected credentials.
100
113
101
114
### Security considerations
102
115
@@ -124,6 +137,8 @@ Refer to the [Manage SSH keys with HCP Boundary and Vault](/boundary/tutorials/h
124
137
125
138
## More information
126
139
140
+
Refer to [Credentials in Boundary](/boundary/docs/credentials) to learn more about how Boundary centralizes credential management to enhance security.
141
+
127
142
To configure credential brokering or credential injection with static credentials, refer to the following topics:
128
143
129
144
-[Create a static credential store](/boundary/docs/credentials/static-cred-boundary)
Copy file name to clipboardExpand all lines: website/content/docs/credentials/configure-credential-injection.mdx
+23-14Lines changed: 23 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,21 +10,30 @@ description: >-
10
10
<EnterpriseAlertproduct="boundary">This feature requires <ahref="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
11
11
12
12
The following section provides steps to configure your targets with credential injection.
13
-
Credential injection provides end users with a passwordless experience when they connect to targets.
13
+
Credential injection provides end users with a passwordless experience when they connect to targets by automatically injecting credentials without exposing them to the user.
- This feature requires either <ahref="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a>
18
-
- You must have an existing target available. If you use the SSH target type, the target must be configured with an injected application credential.
19
-
24
+
- You must have an existing target available that supports credential injection:
25
+
-**RDP targets**: Must be configured with at least one injected application credential
26
+
-**SSH targets**: Must be configured with at least one injected application credential
27
+
-**TCP targets**: Do not support credential injection
20
28
- You must have configured either a static credential store or a Vault credential store:
21
29
22
30
- To configure a static credential store, refer to [Create static credential stores](/boundary/docs/credentials/static-cred-boundary).
23
31
- To configure a Vault credential store and credential library, refer to [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault).
24
32
25
33
- You must have a static credential saved in your static credential store or Vault credential store. The credential must correspond to the target to which you want to authenticate.
26
34
27
-
- Keyboard-interactive authentication is not supported. When you use Username password credentials, ensure that your SSH server is configured to allow password authentication.
35
+
-**For RDP targets**: Network Level Authentication (NLA) is supported. Kerberos and NTLMv2 authentication methods are supported for domain-joined workers. NTLMv2 is supported for non-domain-joined workers.
36
+
-**For SSH targets**: Keyboard-interactive authentication is not supported. When you use username-password credentials, ensure that your SSH server is configured to allow password authentication.
28
37
29
38
## Configuration
30
39
@@ -34,14 +43,14 @@ Complete the following steps to configure targets with credential injection:
34
43
<Tabheading="UI"group="ui">
35
44
36
45
1. Log in to Boundary.
37
-
1. Select **Orgs** on the navigation pane.
38
-
1. Select your desired org.
39
-
1. Select the project where your target resides.
40
-
1. Click **Targets** on the navigation pane.
41
-
1. Click on your target you want to configure for credential injection.
42
-
1. Click on the **Injected Application Credential** tab.
43
-
1. Click **Managed** and select **Add Injected Application Credential** in the pull down menu.
44
-
1. Do one of the following:
46
+
2. Select **Orgs** on the navigation pane.
47
+
3. Select your desired org.
48
+
4. Select the project where your target resides.
49
+
5. Click **Targets** on the navigation pane.
50
+
6. Click on your target you want to configure for credential injection.
51
+
7. Click on the **Injected Application Credential** tab.
52
+
8. Click **Managed** and select **Add Injected Application Credential** in the pull down menu.
53
+
9. Do one of the following:
45
54
-**If you are using a static credential store**: Select the credential that corresponds to your target and click **Add Injected Application Credential**.
46
55
-**If you are using a Vault credential store**: Select the credential library that corresponds to your target and click **Add Injected Application Credential**.
47
56
@@ -56,11 +65,11 @@ Complete the following steps to configure targets with credential injection:
0 commit comments