Properties

Vault injects a rich set of data into the running Sentinel environment, allowing for very fine-grained controls. The set of available properties are enumerated on this page.

The following properties are available for use in Sentinel policies.

Namespace Properties

The namespace (Sentinel) namespace gives access to information about the namespace in which the request is running. (This may or may not match the client's chosen namespace, if a request reaches into a child namespace).

NameTypeDescription
idstringThe namespace ID
pathstringThe root path of the namespace

Request Properties

The following properties are available in the request namespace.

NameTypeDescription
connection.remote_addrstringTCP/IP source address/port of the client
datamap (string -> any)Raw request data
operationstringOperation type, e.g. "read" or "update"
pathstringPath, with any leading / trimmed
policy_overridebooltrue if a soft-mandatory policy override was requested
unauthenticatedbooltrue if the requested path is an unauthenticated path
wrapping.ttldurationThe requested response-wrapping TTL in nanoseconds, suitable for use with the time import
wrapping.ttl_secondsintThe requested response-wrapping TTL in seconds

Replication Properties

The following properties exists at the replication.mode namespace.

NameTypeDescription
drstringThe state of DR replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary"
replicationstringThe state of performance replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary"

Token Properties

The following properties, if available, are in the token namespace. The namespace will not exist if there is no token information attached to a request, e.g. when logging in.

NameTypeDescription
creation_timestringThe timestamp of the token's creation, in RFC3339 format
creation_time_unixintThe timestamp of the token's creation, in seconds since Unix epoch UTC
creation_ttldurationThe TTL the token was first created with in nanoseconds, suitable for use with the time import
creation_ttl_secondsintThe TTL the token was first created with in seconds
display_namestringThe display name set on the token, if any
entity_idstringThe Identity entity ID attached to the token, if any
explicit_max_ttldurationIf the token has an explicit max TTL, the duration of the explicit max TTL in nanoseconds, suitable for use with the time import
explicit_max_ttl_secondsintIf the token has an explicit max TTL, the duration of the explicit max TTL in seconds
metadatamap (string -> string)Metadata set on the token
num_usesintThe number of uses remaining on a use-count-limited token; 0 if the token has no use-count limit
pathstringThe request path that resulted in creation of this token
perioddurationIf the token has a period, the duration of the period in nanoseconds, suitable for use with the time import
period_secondsintIf the token has a period, the duration of the period in seconds
policieslist (string)Policies directly attached to the token
rolestringIf created via a token role, the role that created the token
typestringThe type of token, currently will be either batch or service

Token Namespace Properties

The following properties, if available, are in the token.namespace namespace. The (Sentinel) namespace will not exist if there is no token information attached to a request, e.g. when logging in.

NameTypeDescription
idstringThe namespace ID
pathstringThe root path of the namespace

Identity Properties

The following properties, if available, are in the identity namespace. The namespace may not exist if there is no token information attached to the request; however, at login time the user's request data will be used to attempt to find any existing Identity information, or create some information to pass to MFA functions.

Entity Properties

These exist at the identity.entity namespace.

NameTypeDescription
creation_timestringThe entity's creation time in RFC3339 format
idstringThe entity's ID
last_update_timestringThe entity's last update (modify) time in RFC3339 format
metadatamap (string -> string)Metadata associated with the entity
namestringThe entity's name
merged_entity_idslist (string)A list of IDs of entities that have been merged into this one
aliaseslist (alias)List of aliases associated with this entity
policieslist (string)List of the policies set on this entity

Alias Properties

These can be retrieved from identity.entity.aliases.

NameTypeDescription
creation_timestringThe alias's creation time in RFC3339 format
idstringThe alias's ID
last_update_timestringThe alias's last update (modify) time in RFC3339 format
metadatamap (string -> string)Metadata associated with the alias
merged_from_entity_idslist (string)If this alias was attached to the current entity via one or more merges, the original entity/entities will be in this list
mount_accessorstringThe immutable accessor of the mount that created this alias
mount_pathstringThe path of the mount that created this alias; unlike the accessor, there is no guarantee that the current path represents the original mount
mount_typestringThe type of the mount that created this alias
namestringThe alias's name

Groups Properties

These exist at the identity.groups namespace.

NameTypeDescription
by_idmap (string -> group)A map of group ID to group information
by_namemap (string -> group)A map of group name to group information; unlike the group ID, there is no guarantee that the current name will always represent the same group

Group Properties

These can be retrieved from the identity.groups maps.

NameTypeDescription
creation_timestringThe group's creation time in RFC3339 format
idstringThe group's ID
last_update_timestringThe group's last update (modify) time in RFC3339 format
metadatamap (string -> string)Metadata associated with the group
namestringThe group's name
member_entity_idslist (string)A list of IDs of entities that are directly assigned to this group
parent_group_idslist (string)A list of IDs of groups that are parents of this group
policieslist (string)List of the policies set on this group

MFA Properties

These properties exist at the mfa namespace.

NameTypeDescription
methodsmap (string -> method)A map of method name to method properties

MFA Method Properties

These properties can be accessed via the mfa.methods selector.

NameTypeDescription
validboolWhether the method has successfully been validated; if validation has not been attempted, this will trigger the validation attempt. The result of the validation attempt will be used for this method for all policies for the given request.

Control Group Properties

These properties exist at the controlgroup namespace.

NameTypeDescription
time, request_timestringThe original request time in RFC3339 format
authorizationslist (authorization)List of control group authorizations

Control Group Authorization

These properties can be accessed via the controlgroup.authorizations selector.

NameTypeDescription
timestringThe authorization time in RFC3339 format
entityidentity.entityThe identity entity for the authorizer.
groupsidentity.groupsThe map of identity groups associated with the authorizer.