HashiCorp Vault Associate (003) Question 28
Select 31e Authenticate to Vault using the API, CLI, and UIYour team has enabled the userpass auth method at the default path on a Vault server. A developer can successfully sign in from the Vault UI with username ana and her password. Another engineer needs to automate the same login from a script and also verify the workflow from the CLI during troubleshooting. Which two actions correctly authenticate to Vault using the same auth method?
- A
Run
vault login -method=userpass username=anaand enter the password when prompted. - B
Send a POST request to
/v1/auth/userpass/login/anawith a JSON body containing{ "password": "<ana-password>" }. - C
Run
vault auth enable userpassfrom the CLI before each login attempt so Vault can issue a token. - D
Send a GET request to
/v1/auth/userpass/loginwith query parameters forusername=anaandpassword=<ana-password>. - E
Open the UI, choose the Userpass auth method, and enter
anaplus her password to receive a client token.
Show answer and explanation
Correct answers: A, B, E
Explanation
This scenario tests whether the candidate can map the same authentication workflow across Vault's UI, CLI, and HTTP API. With the userpass auth method enabled at the default path userpass/, all three interfaces use the same underlying auth backend but expose it differently. In the CLI, vault login -method=userpass username=<name> is the standard pattern. In the API, the correct endpoint is POST /v1/auth/userpass/login/:username with the password in the JSON payload. In the UI, the user selects the Userpass method and enters the same credentials. A frequent misconception is confusing auth method enablement with authentication itself, or assuming login endpoints are queried with GET parameters. These flows align with Vault authentication best practices and HashiCorp documentation for auth methods, especially the userpass auth method and the vault login command behavior.
- A. Correct.
Correct. The Vault CLI supports logging in with a specific auth method using
vault login -method=userpass. With userpass, the CLI prompts for the password unless additional parameters are supplied. This is the correct troubleshooting approach from the CLI when the auth method is already enabled. - B. Correct.
Correct. For the HTTP API, the userpass login endpoint is
POST /v1/auth/userpass/login/:username, where the password is provided in the request body. On success, Vault returns an auth block containing the client token and related token metadata. - C. Incorrect.
Incorrect.
vault auth enable userpassenables the auth method on the server; it is an administrative configuration step, not part of the login flow for an end user. Running it before each login is unnecessary and would typically require elevated privileges. - D. Incorrect.
Incorrect. The userpass login API uses an HTTP POST to a username-specific path, not a GET request with query parameters. Using GET here reflects a common misunderstanding of Vault's authentication API structure and would not perform a valid login.
- E. Correct.
Correct. In the UI, a user authenticates by selecting the enabled auth method and entering the required credentials. If userpass is enabled and configured, entering the username and password through the UI is a valid way to receive a Vault token.