GUACAMOLE-2196: Add documentation for OpanBao, HashiCorp Vault

src/include/openbao-optional.properties.in

@@ -0,0 +1,46 @@
+# A username of an account in the Vault for use with Guacamole
+vault-username: guacamole
+
+# A password for the account in the Vault used by Guacamole
+vault-password: my-secret-password
+
+# The lifetime of the data in the Guacamole cache in milliseconds.
+# This is used to avoid multiple concurrent requests for the same
+# Vault record with different secret values. After this time the
+# secret values are cleared from Guacamole
+vault-cache-lifetime: 5000
+
+# The maximum time that a request to the vault server can take in
+# milliseconds. After this time a null value is returned for the
+# secret requested
+vault-request-timeout: 5000
+
+# The maximum time allowed for a connection to the vault server in
+# milliseconds. After this time a null value is returned for the
+# secret requested
+vault-connection-timeout: 5000
+
+# The duration validity of the certificates generated for signed
+# certification SSH connections. After this time the signed certificate
+# can not be reused for a connection.
+#
+# It should be noted that in the case of drift of the clock between the
+# ssh clients and the Vault server in seconds, a certificate might be
+# invalidated incorrectly. This value must be sufficiently large to
+# account for clock drift.
+vault-ssh-connection-timeout: 1800
+
+# The renewal delay for expiring Vault tokens in milliseconds. Tokens
+# will be renewed prior to expiration by this delay
+vault-token-renewal-delay: 10000
+
+# The type of the SSH certificates generated by Guacamole for signed
+# SSH certificate access. Valid types are `ed25519` and `rsa`. Only
+# ed25519 and 4096-bit RSA certificates are supported.
+#
+# Please note that if your server is configured for strict FIPS-140
+# compliance, then ed25519 certificates will not be available, and
+# Guacamole will fallback to using 4096-bit RSA certificates
+# automatically
+vault-ssh-type: ed25519
+

src/include/openbao.properties.in

@@ -0,0 +1,6 @@
+# The URI of the OpenBao or Hashicorp Vault server to use.
+vault-uri: http://localhost:8200
+
+# The authentication token to use to access the vault
+vault-token: s.IPzVb3b5dThhjIrBX245szisjTQcylwSjMEeyJqcidaH8Hf
+

src/index.md

@@ -50,7 +50,7 @@ troubleshooting
 Active Directory / LDAP <ldap-auth>
 mfa
 Single sign-on <sso>
-vault
+Vault token injection<vault>
 external-auth
 RADIUS <radius-auth>
 Ad-hoc connections <adhoc-connections>

src/vault.md.j2 → src/keeper.md.j2

@@ -1,21 +1,20 @@
 {# vim: set filetype=markdown.jinja : #}
 {%- import 'include/ext-macros.md.j2' as ext with context -%}
 
-Retrieving secrets from a vault
-===============================
+Retrieving secrets from a Keeper Secret Manager
+===============================================
 
 Guacamole supports reading secrets such as connection-specific passwords from a
+[Keeper Secret Manager (KSM)](https://www.keepersecurity.com/secrets-manager.html)
 key vault, automatically injecting those secrets into connection configurations
-using [parameter tokens](parameter-tokens) or Guacamole configuration
-properties via an additional, vault-specific configuration file analogous to
-`guacamole.properties`. This support is intended with multiple vault providers
-in mind and currently supports [Keeper Secrets Manager (KSM)](https://www.keepersecurity.com/secrets-manager.html).
-
+using [parameter tokens](parameter-tokens) or Guacamole configuration properties
+via an additional, vault-specific configuration file analogous to
+`guacamole.properties`.
 
 ```{include} include/warn-config-changes.md
 ```
 
-(vault-downloading)=
+(keeper-downloading)=
 
 Installing/Enabling the vault extension
 ---------------------------------------
@@ -83,11 +82,11 @@ question should be able to access.
 
    This token can be used to generate a base64-encoded configuration blob as
    described in the following step, or it can be used directly to set a KSM
-   config for a user or connection, as described in [the following section](guac-vault-config).
+   config for a user or connection, as described in [the following section](guac-keeper-config).
 
 5. Copy the provided one-time token using [the KSM CLI tool](https://docs.keeper.io/secrets-manager/secrets-manager/secrets-manager-command-line-interface/init-command)
    to obtain the base64-encoded configuration that must be provided to
-   Guacamole with [the `ksm-config` property](guac-vault-config). **This token
+   Guacamole with [the `ksm-config` property](guac-keeper-config). **This token
    can only be used once, but the base64 configuration can be used indefinitely
    unless manually revoked within KSM:**
 
@@ -105,7 +104,7 @@ question should be able to access.
    $
    ```
 
-(guac-vault-config)=
+(guac-keeper-config)=
 
 Required configuration
 ----------------------
@@ -178,7 +177,7 @@ The following additional, optional {{ ext.properties() }} may be set as desired
 to tailor the behavior of the KSM support:
 {% endcall %}
 
-(completing-vault-install)=
+(completing-keeper-install)=
 
 Completing installation
 -----------------------