Userpass Authentication: Why Users Get Permission Denied Despite Policy Exists
A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?
Quick Answer
The answer is that the admin simply did not assign any policies to the user when creating the account. In Vault’s Userpass auth method, creating a user with a username and password only establishes the authentication identity; it does not automatically attach any policies. The token issued upon a successful login inherits only the policies explicitly associated with that user entry. Since the admin created 'dev1' without specifying the 'webapp-readonly' policy during user creation or update, the resulting token has zero capabilities, causing the permission denied error despite the policy existing elsewhere. This scenario tests your understanding that policy assignment is a separate, required step from user creation in the Userpass auth method—a common trap on the VA-003 exam where candidates assume a policy’s existence alone grants access. A reliable memory tip: “User creation is the lock; policy assignment is the key—without the key, the token opens nothing.”
⚠ Common exam trap
HashiCorp often tests the nuance that creating a user in Vault does not automatically assign any policies; candidates mistakenly assume that simply creating a user and a policy with the same name is sufficient, but the policy must be explicitly linked to the user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The admin did not assign any policies to the user.
The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy 'webapp-readonly' does not exist.
Why it's wrong here
A missing policy would cause the userpass user creation or policy attachment command to fail outright, and Vault would reject assigning a non-existent policy. The stem states the admin assigned 'webapp-readonly', implying it exists. Policies are referenced by name at user creation; absence would surface as an error there, not as an empty token.
- ✓
The admin did not assign any policies to the user.
Why this is correct
The Userpass auth method requires policies to be attached to the user account itself, not merely created as a standalone policy. Creating 'webapp-readonly' does not bind it to 'dev1'; the admin must associate that policy with the user via the userpass endpoint. Without this association, the issued token carries no policies, producing the permission denied error.
- ✗
The user 'dev1' does not exist.
Why it's wrong here
A non-existent user cannot authenticate at all, so Vault would return an invalid credentials error rather than issuing a token. The stem confirms a token was returned with no policies attached, which requires successful authentication. User existence is validated during the login request, before token issuance.
- ✗
The password is incorrect.
Why it's wrong here
A wrong password returns "invalid credentials" at the login endpoint, not a permission denied error after successful authentication. The token existing with no policies shows the login succeeded, so the credential was accepted. Password accuracy is verified during the Userpass login step itself, before any token or policy assignment occurs.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?
hard- ✓ A.Migrate users to an external identity provider and use LDAP or OIDC auth.
- B.Switch to token-based authentication and issue tokens with TTL.
- C.Use Vault's password policy plugin with Userpass.
- D.Configure password policies in Vault's Userpass auth method.
Why A: The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.