Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. KerberosAuthBackendGroup
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.KerberosAuthBackendGroup

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages LDAP group to Vault policy mappings for the Kerberos authentication method in Vault.

    This resource allows you to map LDAP groups to Vault policies when using the Kerberos authentication method. After a user successfully authenticates via Kerberos, Vault queries LDAP to determine the user’s group memberships. These group mappings then determine which Vault policies are assigned to the authenticated user’s token.

    For more information, see the Vault Kerberos Auth Method documentation.

    Note This resource requires that LDAP integration be configured for the Kerberos auth method using vault.KerberosAuthBackendLdapConfig. Without LDAP configuration, group mappings cannot be resolved.

    Example Usage

    Basic Group Mapping

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const kerberosKerberosAuthBackendConfig = new vault.KerberosAuthBackendConfig("kerberos", {
    mount: kerberos.path,
    keytabWo: std.filebase64({
        input: "/path/to/vault.keytab",
    }).then(invoke => invoke.result),
    keytabWoVersion: 1,
    serviceAccount: "vault/localhost@EXAMPLE.COM",
});
const ldap = new vault.KerberosAuthBackendLdapConfig("ldap", {
    mount: kerberos.path,
    url: "ldap://ldap.example.com",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    userdn: "ou=People,dc=example,dc=org",
    groupdn: "ou=Groups,dc=example,dc=org",
});
const developers = new vault.KerberosAuthBackendGroup("developers", {
    mount: kerberos.path,
    name: "developers",
    policies: [
        "dev-policy",
        "read-only",
    ],
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
kerberos_kerberos_auth_backend_config = vault.KerberosAuthBackendConfig("kerberos",
    mount=kerberos.path,
    keytab_wo=std.filebase64(input="/path/to/vault.keytab").result,
    keytab_wo_version=1,
    service_account="vault/localhost@EXAMPLE.COM")
ldap = vault.KerberosAuthBackendLdapConfig("ldap",
    mount=kerberos.path,
    url="ldap://ldap.example.com",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    userdn="ou=People,dc=example,dc=org",
    groupdn="ou=Groups,dc=example,dc=org")
developers = vault.KerberosAuthBackendGroup("developers",
    mount=kerberos.path,
    name="developers",
    policies=[
        "dev-policy",
        "read-only",
    ])

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "/path/to/vault.keytab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendConfig(ctx, "kerberos", &vault.KerberosAuthBackendConfigArgs{
			Mount:           kerberos.Path,
			KeytabWo:        pulumi.String(invokeFilebase64.Result),
			KeytabWoVersion: pulumi.Int(1),
			ServiceAccount:  pulumi.String("vault/localhost@EXAMPLE.COM"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "ldap", &vault.KerberosAuthBackendLdapConfigArgs{
			Mount:   kerberos.Path,
			Url:     pulumi.String("ldap://ldap.example.com"),
			Binddn:  pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			Userdn:  pulumi.String("ou=People,dc=example,dc=org"),
			Groupdn: pulumi.String("ou=Groups,dc=example,dc=org"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "developers", &vault.KerberosAuthBackendGroupArgs{
			Mount: kerberos.Path,
			Name:  pulumi.String("developers"),
			Policies: pulumi.StringArray{
				pulumi.String("dev-policy"),
				pulumi.String("read-only"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var kerberosKerberosAuthBackendConfig = new Vault.KerberosAuthBackendConfig("kerberos", new()
    {
        Mount = kerberos.Path,
        KeytabWo = Std.Filebase64.Invoke(new()
        {
            Input = "/path/to/vault.keytab",
        }).Apply(invoke => invoke.Result),
        KeytabWoVersion = 1,
        ServiceAccount = "vault/localhost@EXAMPLE.COM",
    });

    var ldap = new Vault.KerberosAuthBackendLdapConfig("ldap", new()
    {
        Mount = kerberos.Path,
        Url = "ldap://ldap.example.com",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        Userdn = "ou=People,dc=example,dc=org",
        Groupdn = "ou=Groups,dc=example,dc=org",
    });

    var developers = new Vault.KerberosAuthBackendGroup("developers", new()
    {
        Mount = kerberos.Path,
        Name = "developers",
        Policies = new[]
        {
            "dev-policy",
            "read-only",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendConfig;
import com.pulumi.vault.KerberosAuthBackendConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import com.pulumi.vault.KerberosAuthBackendGroup;
import com.pulumi.vault.KerberosAuthBackendGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var kerberosKerberosAuthBackendConfig = new KerberosAuthBackendConfig("kerberosKerberosAuthBackendConfig", KerberosAuthBackendConfigArgs.builder()
            .mount(kerberos.path())
            .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()
                .input("/path/to/vault.keytab")
                .build()).result())
            .keytabWoVersion(1)
            .serviceAccount("vault/localhost@EXAMPLE.COM")
            .build());

        var ldap = new KerberosAuthBackendLdapConfig("ldap", KerberosAuthBackendLdapConfigArgs.builder()
            .mount(kerberos.path())
            .url("ldap://ldap.example.com")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .userdn("ou=People,dc=example,dc=org")
            .groupdn("ou=Groups,dc=example,dc=org")
            .build());

        var developers = new KerberosAuthBackendGroup("developers", KerberosAuthBackendGroupArgs.builder()
            .mount(kerberos.path())
            .name("developers")
            .policies(            
                "dev-policy",
                "read-only")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  kerberosKerberosAuthBackendConfig:
    type: vault:KerberosAuthBackendConfig
    name: kerberos
    properties:
      mount: ${kerberos.path}
      keytabWo:
        fn::invoke:
          function: std:filebase64
          arguments:
            input: /path/to/vault.keytab
          return: result
      keytabWoVersion: 1
      serviceAccount: vault/localhost@EXAMPLE.COM
  ldap:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      mount: ${kerberos.path}
      url: ldap://ldap.example.com
      binddn: cn=vault,ou=Users,dc=example,dc=com
      userdn: ou=People,dc=example,dc=org
      groupdn: ou=Groups,dc=example,dc=org
  developers:
    type: vault:KerberosAuthBackendGroup
    properties:
      mount: ${kerberos.path}
      name: developers
      policies:
        - dev-policy
        - read-only

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendconfig" "kerberos" {
  mount             = vault_authbackend.kerberos.path
  keytab_wo         = filebase64("/path/to/vault.keytab")
  keytab_wo_version = 1
  service_account   = "vault/localhost@EXAMPLE.COM"
}
resource "vault_kerberosauthbackendldapconfig" "ldap" {
  mount   = vault_authbackend.kerberos.path
  url     = "ldap://ldap.example.com"
  binddn  = "cn=vault,ou=Users,dc=example,dc=com"
  userdn  = "ou=People,dc=example,dc=org"
  groupdn = "ou=Groups,dc=example,dc=org"
}
resource "vault_kerberosauthbackendgroup" "developers" {
  mount    = vault_authbackend.kerberos.path
  name     = "developers"
  policies = ["dev-policy", "read-only"]
}

    Multiple Group Mappings

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const admins = new vault.KerberosAuthBackendGroup("admins", {
    mount: kerberos.path,
    name: "admins",
    policies: [
        "admin-policy",
        "default",
    ],
});
const developers = new vault.KerberosAuthBackendGroup("developers", {
    mount: kerberos.path,
    name: "developers",
    policies: [
        "dev-policy",
        "default",
    ],
});
const readonly = new vault.KerberosAuthBackendGroup("readonly", {
    mount: kerberos.path,
    name: "readonly-users",
    policies: ["read-only"],
});

    import pulumi
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
admins = vault.KerberosAuthBackendGroup("admins",
    mount=kerberos.path,
    name="admins",
    policies=[
        "admin-policy",
        "default",
    ])
developers = vault.KerberosAuthBackendGroup("developers",
    mount=kerberos.path,
    name="developers",
    policies=[
        "dev-policy",
        "default",
    ])
readonly = vault.KerberosAuthBackendGroup("readonly",
    mount=kerberos.path,
    name="readonly-users",
    policies=["read-only"])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "admins", &vault.KerberosAuthBackendGroupArgs{
			Mount: kerberos.Path,
			Name:  pulumi.String("admins"),
			Policies: pulumi.StringArray{
				pulumi.String("admin-policy"),
				pulumi.String("default"),
			},
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "developers", &vault.KerberosAuthBackendGroupArgs{
			Mount: kerberos.Path,
			Name:  pulumi.String("developers"),
			Policies: pulumi.StringArray{
				pulumi.String("dev-policy"),
				pulumi.String("default"),
			},
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "readonly", &vault.KerberosAuthBackendGroupArgs{
			Mount: kerberos.Path,
			Name:  pulumi.String("readonly-users"),
			Policies: pulumi.StringArray{
				pulumi.String("read-only"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var admins = new Vault.KerberosAuthBackendGroup("admins", new()
    {
        Mount = kerberos.Path,
        Name = "admins",
        Policies = new[]
        {
            "admin-policy",
            "default",
        },
    });

    var developers = new Vault.KerberosAuthBackendGroup("developers", new()
    {
        Mount = kerberos.Path,
        Name = "developers",
        Policies = new[]
        {
            "dev-policy",
            "default",
        },
    });

    var @readonly = new Vault.KerberosAuthBackendGroup("readonly", new()
    {
        Mount = kerberos.Path,
        Name = "readonly-users",
        Policies = new[]
        {
            "read-only",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendGroup;
import com.pulumi.vault.KerberosAuthBackendGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var admins = new KerberosAuthBackendGroup("admins", KerberosAuthBackendGroupArgs.builder()
            .mount(kerberos.path())
            .name("admins")
            .policies(            
                "admin-policy",
                "default")
            .build());

        var developers = new KerberosAuthBackendGroup("developers", KerberosAuthBackendGroupArgs.builder()
            .mount(kerberos.path())
            .name("developers")
            .policies(            
                "dev-policy",
                "default")
            .build());

        var readonly = new KerberosAuthBackendGroup("readonly", KerberosAuthBackendGroupArgs.builder()
            .mount(kerberos.path())
            .name("readonly-users")
            .policies("read-only")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  admins:
    type: vault:KerberosAuthBackendGroup
    properties:
      mount: ${kerberos.path}
      name: admins
      policies:
        - admin-policy
        - default
  developers:
    type: vault:KerberosAuthBackendGroup
    properties:
      mount: ${kerberos.path}
      name: developers
      policies:
        - dev-policy
        - default
  readonly:
    type: vault:KerberosAuthBackendGroup
    properties:
      mount: ${kerberos.path}
      name: readonly-users
      policies:
        - read-only

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendgroup" "admins" {
  mount    = vault_authbackend.kerberos.path
  name     = "admins"
  policies = ["admin-policy", "default"]
}
resource "vault_kerberosauthbackendgroup" "developers" {
  mount    = vault_authbackend.kerberos.path
  name     = "developers"
  policies = ["dev-policy", "default"]
}
resource "vault_kerberosauthbackendgroup" "readonly" {
  mount    = vault_authbackend.kerberos.path
  name     = "readonly-users"
  policies = ["read-only"]
}

    Using Namespace (Vault Enterprise)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.Namespace("example", {path: "example-namespace"});
const kerberos = new vault.AuthBackend("kerberos", {
    namespace: example.path,
    type: "kerberos",
    path: "kerberos",
});
const team = new vault.KerberosAuthBackendGroup("team", {
    namespace: example.path,
    mount: kerberos.path,
    name: "team-alpha",
    policies: ["team-alpha-policy"],
});

    import pulumi
import pulumi_vault as vault

example = vault.Namespace("example", path="example-namespace")
kerberos = vault.AuthBackend("kerberos",
    namespace=example.path,
    type="kerberos",
    path="kerberos")
team = vault.KerberosAuthBackendGroup("team",
    namespace=example.path,
    mount=kerberos.path,
    name="team-alpha",
    policies=["team-alpha-policy"])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.NewNamespace(ctx, "example", &vault.NamespaceArgs{
			Path: pulumi.String("example-namespace"),
		})
		if err != nil {
			return err
		}
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Namespace: example.Path,
			Type:      pulumi.String("kerberos"),
			Path:      pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "team", &vault.KerberosAuthBackendGroupArgs{
			Namespace: example.Path,
			Mount:     kerberos.Path,
			Name:      pulumi.String("team-alpha"),
			Policies: pulumi.StringArray{
				pulumi.String("team-alpha-policy"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.Namespace("example", new()
    {
        Path = "example-namespace",
    });

    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Namespace = example.Path,
        Type = "kerberos",
        Path = "kerberos",
    });

    var team = new Vault.KerberosAuthBackendGroup("team", new()
    {
        Namespace = example.Path,
        Mount = kerberos.Path,
        Name = "team-alpha",
        Policies = new[]
        {
            "team-alpha-policy",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Namespace;
import com.pulumi.vault.NamespaceArgs;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendGroup;
import com.pulumi.vault.KerberosAuthBackendGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Namespace("example", NamespaceArgs.builder()
            .path("example-namespace")
            .build());

        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .namespace(example.path())
            .type("kerberos")
            .path("kerberos")
            .build());

        var team = new KerberosAuthBackendGroup("team", KerberosAuthBackendGroupArgs.builder()
            .namespace(example.path())
            .mount(kerberos.path())
            .name("team-alpha")
            .policies("team-alpha-policy")
            .build());

    }
}

    resources:
  example:
    type: vault:Namespace
    properties:
      path: example-namespace
  kerberos:
    type: vault:AuthBackend
    properties:
      namespace: ${example.path}
      type: kerberos
      path: kerberos
  team:
    type: vault:KerberosAuthBackendGroup
    properties:
      namespace: ${example.path}
      mount: ${kerberos.path}
      name: team-alpha
      policies:
        - team-alpha-policy

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_namespace" "example" {
  path = "example-namespace"
}
resource "vault_authbackend" "kerberos" {
  namespace = vault_namespace.example.path
  type      = "kerberos"
  path      = "kerberos"
}
resource "vault_kerberosauthbackendgroup" "team" {
  namespace = vault_namespace.example.path
  mount     = vault_authbackend.kerberos.path
  name      = "team-alpha"
  policies  = ["team-alpha-policy"]
}

    Group Without Policies

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
// Create a group mapping without policies
// Useful for tracking groups or for later policy assignment
const contractors = new vault.KerberosAuthBackendGroup("contractors", {
    mount: kerberos.path,
    name: "contractors",
});

    import pulumi
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
# Create a group mapping without policies
# Useful for tracking groups or for later policy assignment
contractors = vault.KerberosAuthBackendGroup("contractors",
    mount=kerberos.path,
    name="contractors")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		// Create a group mapping without policies
		// Useful for tracking groups or for later policy assignment
		_, err = vault.NewKerberosAuthBackendGroup(ctx, "contractors", &vault.KerberosAuthBackendGroupArgs{
			Mount: kerberos.Path,
			Name:  pulumi.String("contractors"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    // Create a group mapping without policies
    // Useful for tracking groups or for later policy assignment
    var contractors = new Vault.KerberosAuthBackendGroup("contractors", new()
    {
        Mount = kerberos.Path,
        Name = "contractors",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendGroup;
import com.pulumi.vault.KerberosAuthBackendGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        // Create a group mapping without policies
        // Useful for tracking groups or for later policy assignment
        var contractors = new KerberosAuthBackendGroup("contractors", KerberosAuthBackendGroupArgs.builder()
            .mount(kerberos.path())
            .name("contractors")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  # Create a group mapping without policies
  # Useful for tracking groups or for later policy assignment
  contractors:
    type: vault:KerberosAuthBackendGroup
    properties:
      mount: ${kerberos.path}
      name: contractors

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
# Create a group mapping without policies
# Useful for tracking groups or for later policy assignment
resource "vault_kerberosauthbackendgroup" "contractors" {
  mount = vault_authbackend.kerberos.path
  name  = "contractors"
}

    Create KerberosAuthBackendGroup Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KerberosAuthBackendGroup(name: string, args: KerberosAuthBackendGroupArgs, opts?: CustomResourceOptions);
    @overload
def KerberosAuthBackendGroup(resource_name: str,
                             args: KerberosAuthBackendGroupArgs,
                             opts: Optional[ResourceOptions] = None)

@overload
def KerberosAuthBackendGroup(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             mount: Optional[str] = None,
                             name: Optional[str] = None,
                             namespace: Optional[str] = None,
                             policies: Optional[Sequence[str]] = None)
    func NewKerberosAuthBackendGroup(ctx *Context, name string, args KerberosAuthBackendGroupArgs, opts ...ResourceOption) (*KerberosAuthBackendGroup, error)
    public KerberosAuthBackendGroup(string name, KerberosAuthBackendGroupArgs args, CustomResourceOptions? opts = null)
    public KerberosAuthBackendGroup(String name, KerberosAuthBackendGroupArgs args)
public KerberosAuthBackendGroup(String name, KerberosAuthBackendGroupArgs args, CustomResourceOptions options)

    type: vault:KerberosAuthBackendGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_kerberos_auth_backend_group" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KerberosAuthBackendGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KerberosAuthBackendGroupArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KerberosAuthBackendGroupArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KerberosAuthBackendGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KerberosAuthBackendGroupArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kerberosAuthBackendGroupResource = new Vault.KerberosAuthBackendGroup("kerberosAuthBackendGroupResource", new()
{
    Mount = "string",
    Name = "string",
    Namespace = "string",
    Policies = new[]
    {
        "string",
    },
});

    example, err := vault.NewKerberosAuthBackendGroup(ctx, "kerberosAuthBackendGroupResource", &vault.KerberosAuthBackendGroupArgs{
	Mount:     pulumi.String("string"),
	Name:      pulumi.String("string"),
	Namespace: pulumi.String("string"),
	Policies: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "vault_kerberos_auth_backend_group" "kerberosAuthBackendGroupResource" {
  lifecycle {
    create_before_destroy = true
  }
  mount     = "string"
  name      = "string"
  namespace = "string"
  policies  = ["string"]
}

    var kerberosAuthBackendGroupResource = new KerberosAuthBackendGroup("kerberosAuthBackendGroupResource", KerberosAuthBackendGroupArgs.builder()
    .mount("string")
    .name("string")
    .namespace("string")
    .policies("string")
    .build());

    kerberos_auth_backend_group_resource = vault.KerberosAuthBackendGroup("kerberosAuthBackendGroupResource",
    mount="string",
    name="string",
    namespace="string",
    policies=["string"])

    const kerberosAuthBackendGroupResource = new vault.KerberosAuthBackendGroup("kerberosAuthBackendGroupResource", {
    mount: "string",
    name: "string",
    namespace: "string",
    policies: ["string"],
});

    type: vault:KerberosAuthBackendGroup
properties:
    mount: string
    name: string
    namespace: string
    policies:
        - string

    KerberosAuthBackendGroup Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KerberosAuthBackendGroup resource accepts the following input properties:

    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Policies List<string>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Policies []string
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies list(string)
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name String
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies List<String>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies string[]
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name str
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies Sequence[str]
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name String
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies List<String>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KerberosAuthBackendGroup resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing KerberosAuthBackendGroup Resource

    Get an existing KerberosAuthBackendGroup resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KerberosAuthBackendGroupState, opts?: CustomResourceOptions): KerberosAuthBackendGroup
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        policies: Optional[Sequence[str]] = None) -> KerberosAuthBackendGroup
    func GetKerberosAuthBackendGroup(ctx *Context, name string, id IDInput, state *KerberosAuthBackendGroupState, opts ...ResourceOption) (*KerberosAuthBackendGroup, error)
    public static KerberosAuthBackendGroup Get(string name, Input<string> id, KerberosAuthBackendGroupState? state, CustomResourceOptions? opts = null)
    public static KerberosAuthBackendGroup get(String name, Output<String> id, KerberosAuthBackendGroupState state, CustomResourceOptions options)
    resources:  _:    type: vault:KerberosAuthBackendGroup    get:      id: ${id}
    import {
  to = vault_kerberos_auth_backend_group.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Policies List<string>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Policies []string
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies list(string)
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name String
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies List<String>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name string
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies string[]
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name str
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies Sequence[str]
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    name String
    The name of the LDAP group to map to Vault policies. This should match the group name as it appears in your LDAP directory. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    policies List<String>
    Set of Vault policy names to associate with this group. Users who are members of this LDAP group will receive these policies when they authenticate via Kerberos.

    Import

    Kerberos auth backend group mappings can be imported using the path, e.g.

    $ pulumi import vault:index/kerberosAuthBackendGroup:KerberosAuthBackendGroup developers auth/kerberos/groups/developers

    Importing with Namespace (Vault Enterprise)

    For Vault Enterprise with namespaces, set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable before importing:

    $ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace
$ terraform import vault_kerberos_auth_backend_group.developers auth/kerberos/groups/developers

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial