An employee authenticates to Vault through LDAP, then the LDAP account is disabled in the external directory. What should the security team expect for the already-issued Vault token?

Question

Accepted Answer

B. It remains valid until its granted lifetime ends, but renewal requests are denied. Vault checks external auth systems during authentication and renewal, so renewal can be denied after the directory account is disabled while the existing token remains valid until expiry. Option a is wrong because Vault does not automatically revoke every already-issued token the moment the external account changes.

An employee authenticates to Vault through LDAP, then the LDAP account is disabled in the external directory. What should the security team expect for the already-issued Vault token?

Related Questions

Discussion