https://articles.maximemoreillon.com/tags/hashicorp-vault/ Recent content in HashiCorp Vault on Maxime Moreillon Hugo -- gohugo.io en-us Sat, 18 Apr 2026 00:00:00 +0000 https://articles.maximemoreillon.com/articles/vault-oidc-keycloak/ Sat, 18 Apr 2026 00:00:00 +0000 https://articles.maximemoreillon.com/articles/vault-oidc-keycloak/ <p><a href="https://www.hashicorp.com/en/products/vault">HashiCorp Vault</a> supports authenticating users via OIDC, which means it can delegate login to an existing <a href="https://www.keycloak.org/">Keycloak</a> instance instead of managing its own set of credentials.</p> <h2 id="keycloak-client-settings">Keycloak client settings</h2> <p>In Keycloak, create a client for Vault with <em>Client authentication</em> set to <code>ON</code>, so that Keycloak issues a client secret for it.</p> <h2 id="policy">Policy</h2> <p>Vault&rsquo;s OIDC role needs to be mapped to a policy. The built-in <code>root</code> policy cannot be used for this, so a separate <code>admin</code> policy granting the needed capabilities has to be created instead and used in the role below.</p>