菜单
Deploy, verify, and troubleshoot the Vault LDAP auth plus LDAP secrets engine lab in hal. Use when the user asks for LDAP login, directory-backed auth, dynamic/static/library LDAP secrets, or LDAP lab reset.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.
Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.
Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.
Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.
Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".
Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".
| name | ldap |
| description | Deploy, verify, and troubleshoot the Vault LDAP auth plus LDAP secrets engine lab in hal. Use when the user asks for LDAP login, directory-backed auth, dynamic/static/library LDAP secrets, or LDAP lab reset. |
This skill covers the OpenLDAP + phpLDAPadmin + Vault LDAP auth/secrets workflow implemented by hal vault ldap.
http://vault.localhost:8200roothal-openldaphttps://phpldapadmin.localhost:8082hal for lifecycle and vault read/write for day-2 checksldap/kv-ldap/ldap/ldap-admin, ldap-readerldap/role/dynamic-readerldap/static-role/static-appldap/library/dev-poolldap/rotate-rootUse smart status mode if needed:
hal vault ldap
Then run one of these:
hal vault ldap enable
hal vault ldap --update
hal vault ldap disable
If Vault MCP is available, inspect:
auth/ldap/configauth/ldap/groups/adminauth/ldap/groups/readerldap/configldap/role/dynamic-readerldap/static-role/static-appldap/library/dev-poolIf MCP is unavailable, use:
export VAULT_ADDR='http://vault.localhost:8200'
export VAULT_TOKEN='root'
vault read auth/ldap/config
vault read ldap/config
vault read ldap/role/dynamic-reader
vault read ldap/static-role/static-app
vault read ldap/library/dev-pool
Tier 1 - Success Summary Confirm LDAP auth and LDAP secrets are both configured.
Tier 2 - Configuration Details Table
| Component | Value | Description |
|---|---|---|
| Auth Mount | auth/ldap/ | Human login against OpenLDAP |
| Secrets Mount | ldap/ | LDAP secrets engine |
| Dynamic Role | dynamic-reader | Short-lived generated user |
| Static Role | static-app | Rotated static service account |
| Library | dev-pool | Check-out/check-in pooled credentials |
Tier 3 - Actionable Testing Commands
vault login -method=ldap username=bob password=password
vault read ldap/creds/dynamic-reader
vault read ldap/static-cred/static-app
vault write -f ldap/library/dev-pool/check-out
hal vault ldap --update so Vault lease and mount cleanup runs before container removal.