Rotate passwords for Test Users

Vault
1

We have a user case where we have a dozen test users in AD that our developers use from time to time to test functionality of apps they’ve recently deployed. We’d like to use Vault to rotate the password for these test users.

Our requirements are:

  • A developers should “check out” a test user, so that it is reserved for that developer for a period of time.
  • The password for these test users should be managed by Vault, rotated automatically (whether that be on a schedule or upon checkout).

How would you recommend we implement this in Vault? Should we create a new LDAP secret engine dedicated to these test users? Is there a way to use paths within our existing LDAP engine so that these test users are separate from our service account (for ACL reasons)?

2

Depending on your security requirements, a separate LDAP secrets engine is not a bad option if you require strict separation between the test users and regular service account users.

And sounds like you use service account check out with your LDAP secrets engine: