메뉴
Deploy, verify, and troubleshoot the Vault LDAP auth plus LDAP secrets engine lab in hal. Use when the user asks for LDAP login, directory-backed auth, dynamic/static/library LDAP secrets, or LDAP lab reset.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.
Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.
Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.
Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.
Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".
Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".
| name | ldap |
| description | Deploy, verify, and troubleshoot the Vault LDAP auth plus LDAP secrets engine lab in hal. Use when the user asks for LDAP login, directory-backed auth, dynamic/static/library LDAP secrets, or LDAP lab reset. |
This skill covers the OpenLDAP + phpLDAPadmin + Vault LDAP auth/secrets workflow implemented by hal vault ldap.
http://vault.localhost:8200roothal-openldaphttps://phpldapadmin.localhost:8082hal for lifecycle and vault read/write for day-2 checksldap/kv-ldap/ldap/ldap-admin, ldap-readerldap/role/dynamic-readerldap/static-role/static-appldap/library/dev-poolldap/rotate-rootUse smart status mode if needed:
hal vault ldap
Then run one of these:
hal vault ldap enable
hal vault ldap --update
hal vault ldap disable
If Vault MCP is available, inspect:
auth/ldap/configauth/ldap/groups/adminauth/ldap/groups/readerldap/configldap/role/dynamic-readerldap/static-role/static-appldap/library/dev-poolIf MCP is unavailable, use:
export VAULT_ADDR='http://vault.localhost:8200'
export VAULT_TOKEN='root'
vault read auth/ldap/config
vault read ldap/config
vault read ldap/role/dynamic-reader
vault read ldap/static-role/static-app
vault read ldap/library/dev-pool
Tier 1 - Success Summary Confirm LDAP auth and LDAP secrets are both configured.
Tier 2 - Configuration Details Table
| Component | Value | Description |
|---|---|---|
| Auth Mount | auth/ldap/ | Human login against OpenLDAP |
| Secrets Mount | ldap/ | LDAP secrets engine |
| Dynamic Role | dynamic-reader | Short-lived generated user |
| Static Role | static-app | Rotated static service account |
| Library | dev-pool | Check-out/check-in pooled credentials |
Tier 3 - Actionable Testing Commands
vault login -method=ldap username=bob password=password
vault read ldap/creds/dynamic-reader
vault read ldap/static-cred/static-app
vault write -f ldap/library/dev-pool/check-out
hal vault ldap --update so Vault lease and mount cleanup runs before container removal.