Skip to content

Commit d623bce

Browse files
backport of commit f661f43 (#26124)
Co-authored-by: Sarah Chavis <[email protected]>
1 parent 4bfb027 commit d623bce

File tree

2 files changed

+31
-0
lines changed

2 files changed

+31
-0
lines changed

website/content/docs/ui/index.mdx

+4
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ at `http://127.0.0.1:8200/ui` and ready to use.
4646

4747
</Note>
4848

49+
## Policy requirements
50+
51+
@include 'ui/policy-requirements.mdx'
52+
4953
## Tutorial
5054

5155
Refer to the [UI quick start](/vault/tutorials/getting-started-ui) tutorials to
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<Warning title="Set UI policies before enabling the UI">
2+
3+
You cannot make policy adjustments or overwrites to the <code>ui/mounts</code>
4+
and <code>ui/resultant-acl</code> endpoints once you enable the Vault UI. Vault
5+
ignores policy updates that target these paths
6+
with <a href="/vault/docs/concepts/policies#deny">explicit <code>deny</code></a> capabilities.
7+
8+
</Warning>
9+
10+
Depending on your Vault configuration, you may need to define UI policies
11+
with different ACL capabilities from the permissions provided by your Vault CLI
12+
policies.
13+
14+
The `default` UI policy includes two paths, **which cannot be modified with
15+
additional policies** once you
16+
[enable](/vault/docs/configuration/ui#activating-the-vault-ui) the UI:
17+
18+
- [/sys/internal/ui/mounts](/vault/api-docs/system/internal-ui-mounts) -
19+
provides a list of currently visible mounts based on the
20+
[`listing_visibility`](/vault/api-docs/system/mounts#listing_visibility)
21+
parameter. `sys/internal/ui/mounts` is an unauthenticated, internal endpoint
22+
used for UI and CLI preflight checks. Requests that include an `X-Vault-Token`
23+
will return all mounts the token has path capabilities on.
24+
- [/sys/internal/ui/resultant-acl](/vault/api-docs/system/internal-ui-resultant-acl) -
25+
repackages authentication information used by the UI. **If you do not have have
26+
permission to call the `ui/resultant-acl` endpoint, you may receive warnings or
27+
errors in the UI**.

0 commit comments

Comments
 (0)