AD via OIDC groups claim

Vault
3

I use a combination of roles and Identity Groups.

On the role

  • groups_claim is groups

Create an Identity Group:

  • name is your desired group name (can match your AzureAD group name or can be something unique)
  • type is external

Finally create an Identity Group Alias:

  • canonical_id is the internal ID number of your Identity Group created above
  • name is the group ID in Azure (usually formatted as a UUID)
  • mount_accessor is the accessor ID of your Azure JWT auth method mount

If you don’t want to use Identity Secrets you may be able to specify the bound_claims parameter on the role (please note that I have not tested this with AzureAD/OIDC):

  • bound_claims is a map of group = <azuread_group_id>
1 Like
Vault secret access to specific group members
Vault auth with Azure AD