Question regarding identity groups pull in entities and groups from other namespaces

Vault
1

Hello,

I’m using vault enterprise with multiple namespaces. I read the tutorial here Secure multi-tenancy with namespaces | Vault | HashiCorp Developer, it said

Identity groups can pull in entities and groups from other namespaces.

And in the example, identity group “Training Admin” in namespace “education/training” pulls in entity “Bob Smith” from namespace “education”. I had a try and it works well.

Then I tried to have identity group in namespace “education/training” pull in entity from another namespace “education/programming”, it didn’t work.

Does that mean identity groups can only pull in entities and groups from parent namespaces? Can we clarify the scope of “other namespaces” in tutorial?

Thanks!

2

I think that is correct.

My understanding is that when you log in to a namespace, you’re by design limited to accessing things within your login namespace and its children.

Therefore in practice you generally want everyone to always log in to the root namespace, when you’re working with multiple business units within an organisation, who need to expose Vault resources to each other.

Logging in to child namespaces is designed only for working with completely isolated tenants with no interactions.