Password policy for Database Secrets Engine for Vault

Vault
#1

Guru of Vault,

We are setting up the Database Secrets Engine for Mariadb in Vault to generate dynamic credentials. The password of generated user looks like the following:
A1a-ialfWVgzEEGtR58q.

What is the exact password policy here? Is there any way we can set such policy explicitly? Thanks.

#2

Secrets engines with support for password policies:
Active Directory
Azure
OpenLDAP
RabbitMQ

1 Like
#3

Thanks for the reply. I understand that the db engine doesn’t support password policies. But is there anyway I can see the policy it’s using internally. Is there any source code I can read?

Basically, we are facing certain auditing situation. The auditors want evidence that the temporary password generated by Vault DB engine will be at least 10 character and have both number and alphabet. It seems true from concrete example. But I cannot find any document for this in Vault. Thanks a lot.

#4

I’m confused. There’s actually another line in the tutorial that @Wolfsrudel quoted (my emphasis):

Secrets engines with support for password policies:

Here’s the parameter supported by all database secret engines (including MySQL/MariaDB): https://www.vaultproject.io/api/secret/databases#password_policy

Could that not suit your purposes?

#5

Expanded Password Policy Support : Custom password policies are now supported for all database engines.

Part of version 1.6, which wasn’t released at the time of my comment and so the documentation was at an older release without “All Databases”.

1 Like
#6

Ah, that makes more sense. Didn’t imagine you’d missed it! :wink: Cheers!

1 Like
#7

“It is not as constant as change.” :upside_down_face:

1 Like
#8

@alex-ren

Maybe this will help.

The code that generates the password. (10 to 20 characters)