OpenBao transit encryption as a service
Using the transit engine so applications encrypt, sign and HMAC data without handling keys, with key rotation, convergent encryption, imported keys and the external key option added in 2.7.0.
OpenBao features
OpenBao secrets engines and governance features beyond key/value storage, PKI and database credentials.
OpenBao SSH certificate authority
Replacing static SSH keys with short-lived signed certificates or one-time passwords from the SSH secrets engine, and rolling the trusted CA out to hosts.
OpenBao namespaces and multi-tenancy
Designing namespaces for teams or customers in one OpenBao cluster: policy boundaries, delegated administration and how namespaces differ from separate clusters.
OpenBao audit devices and logging
Configuring file, syslog, socket and HTTP audit devices, running more than one so an audit failure does not block requests, and forwarding HMAC-hashed logs to a SIEM.
OpenBao control groups for dual approval
Requiring a second approver before sensitive secrets or certificates are released, using the control group policy stanza added in 2.7.0, and building the approver notification OpenBao does not send.
OpenBao as an OIDC identity provider
Using OpenBao's built-in OIDC provider so internal applications and services authenticate through OpenBao identities, and when a dedicated identity provider such as Keycloak is the better fit.
