File tree 2 files changed +31
-0
lines changed
2 files changed +31
-0
lines changed Original file line number Diff line number Diff line change @@ -46,6 +46,10 @@ at `http://127.0.0.1:8200/ui` and ready to use.
46
46
47
47
</Note >
48
48
49
+ ## Policy requirements
50
+
51
+ @include 'ui/policy-requirements.mdx'
52
+
49
53
## Tutorial
50
54
51
55
Refer to the [ UI quick start] ( /vault/tutorials/getting-started-ui ) tutorials to
Original file line number Diff line number Diff line change
1
+ <Warning title = " Set UI policies before enabling the UI" >
2
+
3
+ You cannot make policy adjustments or overwrites to the <code >ui/mounts</code >
4
+ and <code >ui/resultant-acl</code > endpoints once you enable the Vault UI. Vault
5
+ ignores policy updates that target these paths
6
+ with <a href = " /vault/docs/concepts/policies#deny" >explicit <code >deny</code ></a > capabilities.
7
+
8
+ </Warning >
9
+
10
+ Depending on your Vault configuration, you may need to define UI policies
11
+ with different ACL capabilities from the permissions provided by your Vault CLI
12
+ policies.
13
+
14
+ The ` default ` UI policy includes two paths, ** which cannot be modified with
15
+ additional policies** once you
16
+ [ enable] ( /vault/docs/configuration/ui#activating-the-vault-ui ) the UI:
17
+
18
+ - [ /sys/internal/ui/mounts] ( /vault/api-docs/system/internal-ui-mounts ) -
19
+ provides a list of currently visible mounts based on the
20
+ [ ` listing_visibility ` ] ( /vault/api-docs/system/mounts#listing_visibility )
21
+ parameter. ` sys/internal/ui/mounts ` is an unauthenticated, internal endpoint
22
+ used for UI and CLI preflight checks. Requests that include an ` X-Vault-Token `
23
+ will return all mounts the token has path capabilities on.
24
+ - [ /sys/internal/ui/resultant-acl] ( /vault/api-docs/system/internal-ui-resultant-acl ) -
25
+ repackages authentication information used by the UI. ** If you do not have have
26
+ permission to call the ` ui/resultant-acl ` endpoint, you may receive warnings or
27
+ errors in the UI** .
You can’t perform that action at this time.
0 commit comments