mirror of
https://github.com/hashicorp/vault.git
synced 2025-11-13 14:51:34 +01:00
5c6720e9e0
* remove mount accessor from MFA config * Update login_mfa_duo_test.go * DUO test with entity templating * using identitytpl.PopulateString to perform templating * minor refactoring * fixing fmt failures in CI * change username format to username template * fixing username_template example
148 lines
3.8 KiB
Plaintext
148 lines
3.8 KiB
Plaintext
---
|
||
layout: api
|
||
page_title: /identity/mfa/method/pingid - HTTP API
|
||
description: >-
|
||
The '/identity/mfa/method/pingid' endpoint focuses on managing PingID MFA behaviors in Vault.
|
||
---
|
||
|
||
## Configure PingID MFA Method
|
||
|
||
This endpoint defines an MFA method of type PingID.
|
||
|
||
| Method | Path |
|
||
| :----- |:----------------------------------|
|
||
| `POST` | `/identity/mfa/method/pingid/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: "")` - Optional UUID to specify if updating an existing method.
|
||
|
||
- `mount_accessor` `(string: <required>)` - The mount to tie this method to for use in automatic mappings. The mapping
|
||
will use the Name field of Aliases associated with this mount as the username in the mapping. Note that this can
|
||
be from the current namespace or a child namespace.
|
||
|
||
- `username_template` `(string)` - A template string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{identity.entity.name}}@example.com"`. If blank, the Entity's Name field is used as-is.
|
||
|
||
- `settings_file_base64` `(string: <required>)` - A base64-encoded third-party settings file retrieved from PingID's configuration page.
|
||
|
||
### Sample Payload
|
||
|
||
```json
|
||
{
|
||
"mount_accessor": "auth_userpass_1793464a",
|
||
"settings_file_base64": "AA8owj3..."
|
||
}
|
||
```
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/pingid
|
||
```
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
|
||
```
|
||
|
||
## Read PingID MFA Method
|
||
|
||
This endpoint queries the MFA configuration of PingID type for a given method
|
||
name.
|
||
|
||
| Method | Path |
|
||
| :----- |:----------------------------------|
|
||
| `GET` | `/identity/mfa/method/pingid/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: <required>)` – UUID of the MFA method.
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request GET \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
|
||
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"use_signature": true,
|
||
"idp_url": "https://idpxnyl3m.pingidentity.com/pingid",
|
||
"admin_url": "https://idpxnyl3m.pingidentity.com/pingid",
|
||
"authenticator_url": "https://authenticator.pingone.com/pingid/ppm",
|
||
"mount_accessor": "auth_userpass_1793464a",
|
||
"id": "f8381105-67f0-4105-8662-4b07ae5c1233",
|
||
"org_alias": "181459b0-9fb1-4938-8c86...",
|
||
"type": "pingid",
|
||
"username_template": ""
|
||
}
|
||
}
|
||
```
|
||
|
||
## Delete PingID MFA Method
|
||
|
||
This endpoint deletes a PingID MFA method. MFA methods can only be deleted if they're not currently in use
|
||
by a [login enforcement](/api/secret/identity/mfa/login-enforcement).
|
||
|
||
| Method | Path |
|
||
| :------- |:----------------------------------|
|
||
| `DELETE` | `/identity/mfa/method/pingid/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: <required>)` - UUID of the MFA method.
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request DELETE \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
|
||
|
||
```
|
||
|
||
## List PingID MFA Methods
|
||
|
||
This endpoint lists PingID MFA methods that are visible in the current namespace or in parent namespaces.
|
||
|
||
| Method | Path |
|
||
|:-------|:------------------------------|
|
||
| `LIST` | `/identity/mfa/method/pingid` |
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request LIST \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/pingid
|
||
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"keys": [
|
||
"f8381105-67f0-4105-8662-4b07ae5c1233"
|
||
]
|
||
}
|
||
}
|
||
```
|