Hashicorp Boundary | Entitle

Overview

HashiCorp Boundary is an open-source solution that provides automated, secure, and identity-based user access to hosts and services across environments. It allows centralized administration and reduces the need for distributed, long-lived credentials by providing just-in-time access.

Entitle can manage roles and groups in HashiCorp Boundary organizations.

This page will provide you with instructions on how to integrate Entitle and HashiCorp Boundary.

General guidelines

In order to integrate HashiCorp Boundary with Entitle, you will need to set the following:

• Provide Entitle with an admin's credentials.
• Provide Entitle with your HashiCorp Boundary cluster URL.
• Generate a password for the project you choose to integrate with Entitle.

Prerequisites

• An admin account for HashiCorp Boundary.

Set up HashiCorp Boundary to work with Entitle

Stage 1: Get the server URL and admin credentials

1. Sign in to your HashiCorp Boundary cluster with an admin account.
2. Copy the admin's username, password, and the cluster URL, as you will use it later.

Stage 2: Generate a password method ID

ℹ️

If you already have configured an authentication method in your Boundary tenant - you can skip this step and use the preconfigured password ID.

The password ID can be found in step 4 of this Stage.

1. Within the selected org, click on the Auth Methods button.

2. Click on the New button to the right, and then choose the Password auth method.

3. Add an indicative name under the Name field, and click Save.

4. Click on the newly created auth method, and copy the password ID, as you will use it later on.

Creating the integration in Entitle

1. Sign in to Entitle and go to the Integrations page.
2. After clicking the ‘Add Integration’ button, type 'Hashicorp Boundary' in the Application field.
3. Don’t forget to set ‘Save on’ correctly on your agent or Entitle’s cloud.

4. Paste the admin's account username copied at Stage 1, step 2 into the admin field.

5. Paste the admin's account password copied at Stage 1, step 2 into the password field.

6. Paste your Boundary cluster URL copied at Stage 1, step 2 into the server field.

7. Paste the password you created at Stage 2, step 4 into the generated_passed_method_id field.

   ✅

   Example configuration JSON

   JSON

   {
     "admin": "<ADMIN_ACCOUNT_USERNAME>",
     "password": "<ADMIN_ACCOUNT_PASSWORD>",
     "server": "http://BOUNDERY_DOMAIN>:<PORT>",
     "generated_passwd_method_id": "<PASSWORD_METHOD_ID>"
   }

8. Click Save.

Store Entitle secrets in a folder inside HashiCorp Vault

Entitle can store and read secrets in HashiCorp Vault. You tell Entitle where to keep these secrets with the KV mount setting.

Starting in October of 2026, the KV mount setting can point to a folder inside an existing key-value (KV) version 2 secrets engine. You no longer need a separate engine just for Entitle. You can place Entitle's secrets in any folder within an engine your team already uses.

What changes

Before this release

• The KV mount setting works only when it points directly to an engine.
• If you point it to a folder inside an engine, Entitle looks for secrets in the wrong place.
• Entitle always tries to create a new engine. If its Vault token does not have permission to create engines, saving a secret fails.

With this release

• The KV mount setting accepts a folder path inside an existing KV version 2 engine.
• Entitle finds the engine and the folder on its own and reads and writes secrets in the correct location.
• Entitle works with a limited, least-privilege Vault token. The token does not need permission to create or list engines.

Example

Your Vault server has a KV version 2 engine named cloud-services. Inside that engine, your team creates a folder for Entitle, such as pce > entitle > kms.

You enter the full folder path in the KV mount setting. Entitle now stores its secrets in that folder. Before this release, this setup fails unless the folder is its own engine.

Who benefits

• Security teams that follow least-privilege rules. Entitle's Vault token needs access only to the folder Entitle uses.
• Vault administrators who want to keep secrets organized in one shared engine instead of adding new engines for each tool.
• Teams with strict Vault policies that block engine creation.

What you need to do

• New setups: Enter the folder path in the KV mount setting when you configure the HashiCorp Vault integration.
• Existing setups: No action is required. Setups that point directly to an engine keep working as they do today.
• Vault permissions: Make sure the Entitle token can read, write, and list secrets in the target folder. The token does not need engine management permissions.