Configure targets with credential injection

Configure targets with credential injection

출처: HashiCorp Boundary docs

Configuring credential injection for an SSH or RDP target lets Boundary inject the matching credential directly into the session, so users connect without ever seeing or entering a password. TCP targets don't support this workflow.

This page assumes you already have an SSH or RDP target and a credential store configured. TCP targets aren't covered here since they don't support credential injection.

Credential injection is supported for:

  • SSH targets: Protocol-aware SSH connections
  • RDP targets: Protocol-aware RDP connections

Requirements

You must have an existing target available that supports credential injection: | Target type | Injection support | Requirement | | RDP targets | Supported | Must be configured with at least one injected application credential | | SSH targets | Supported | Must be configured with at least one injected application credential | | TCP targets | Not supported | N/A |

  • To configure a static credential store, refer to Create static credential stores.To configure a Vault credential store and credential library, refer to Create Vault credential stores.
  • UDP transport must be disabled.Server redirection is not supported.The maximum supported TLS version is 1.2. TLS 1.3 is incompatible with Windows Server 2025.

Configuration

Complete the following steps to configure targets with credential injection: UI CLI Terraform

  • Log in to Boundary.

  • Select Orgs on the navigation pane.

  • Select your desired org.

  • Select the project where your target resides.

  • Click Targets on the navigation pane.

  • Click on your target you want to configure for credential injection.

  • Click on the Injected Application Credential tab.

  • Click Managed and select Add Injected Application Credential in the pull down menu.

  • Do one of the following:If you are using a static credential store: Select the credential that corresponds to your target and click Add Injected Application Credential.If you are using a Vault credential store: Select the credential library that corresponds to your target and click Add Injected Application Credential.

$ boundary authenticate Please enter the login name (it will be hidden): Please enter the password (it will be hidden):

- ```
$ boundary targets add-credential-sources \
  -id trdp_vO60a7TwpI \
  -injected-application-credential-source csvlt_Xqa6V6QwfM

Tip If you are using a static credential store, brokered-credential-source refers to the ID of a credential in the static credential store.

If you are using a Vault credential store, brokered-credential-source refers to the ID of a credential library in the Vault credential store. Apply the following Terraform configuration to create a target ssh_foo and add injected credentials to it.

resource "boundary_target" "ssh_foo" {
  name         = "ssh_foo"
  description  = "SSH target"
  type         = "ssh"
  address      = "127.0.0.1"
  default_port = "22"
  scope_id     = boundary_scope.project.id
  injected_application_credential_source_ids = [
    boundary_credential_library_vault.foo.id
  ]
}

More information

Refer to the following topics for more information:

  • Create static credential stores
  • Create Vault credential stores
  • Target types
  • Credentials
  • RDP credential injection compatibility matrix

Edit this page on GitHub