HashiCorp Vault Associate (003) Question 21
Single answer1d Define the purpose of identities and groupsA company uses Vault with multiple auth methods. Employees authenticate through OIDC for interactive use and through LDAP for a legacy internal portal. The security team wants each employee to receive the same Vault policies regardless of which auth method they use, and they also want to grant extra access to everyone on the Database team without attaching policies separately to each auth method. Which Vault design best meets these requirements?
- A
Create identity entities for users, link their OIDC and LDAP aliases to the same entity, and assign shared policies through identity groups for teams such as Database.
- B
Attach the same policies directly to both the OIDC auth method and the LDAP auth method, because auth methods automatically merge users into one identity when usernames match.
- C
Create a separate token role for each employee and use token roles to combine OIDC and LDAP logins into a single user record with team-based access.
- D
Use namespaces to represent each employee and assign team policies at the namespace level so access is consistent across authentication methods.
Show answer and explanation
Correct answer: A
Explanation
The purpose of Vault identities is to provide a consistent internal representation of a client across one or more auth methods. This is done with entities and aliases: each login from an auth method creates or maps to an alias, and aliases can be associated to a single entity. The purpose of groups is to simplify policy assignment for collections of entities, such as teams or departments, so access can be managed centrally rather than repeated on every auth method. In this scenario, the best practice is to map each employee's OIDC and LDAP logins to the same entity and then use identity groups to assign team-specific policies. This aligns with Vault's Identity secrets engine concepts and recommended access management patterns in HashiCorp Vault documentation covering entities, aliases, and groups.
- A. Correct.
Correct. In Vault, the identity system provides a unified representation of a user through an entity. Multiple aliases from different auth methods, such as OIDC and LDAP, can map to the same entity so the user is recognized consistently across logins. Groups are used to collect entities and assign policies centrally, which is the right way to grant team-based access such as Database-team permissions without duplicating policy assignment per auth method.
- B. Incorrect.
Incorrect. Vault does not automatically merge users from different auth methods just because usernames match. Identity alias mapping is required to associate multiple auth method logins with the same entity. Also, attaching policies separately to each auth method duplicates administration and does not provide a clean team-based model.
- C. Incorrect.
Incorrect. Token roles are used for creating and constraining tokens, especially with token creation workflows, but they do not serve as the primary mechanism for unifying identities across auth methods or for modeling team membership. This option confuses token management with the identity and group features.
- D. Incorrect.
Incorrect. Namespaces are an Enterprise feature used for multi-tenancy and administrative isolation, not for representing individual users or unifying identities across auth methods. Assigning a namespace per employee would be the wrong design and would not address the purpose of entities and groups.