Fix: override default restritive policy for identity admin.

.gitignore

@@ -1,4 +1,5 @@
-config
+/config
-data
+/data
-log
+/log
 **/*.key
+default_policy.hcl

policies/admin_policy.hcl

@@ -32,14 +32,6 @@ path "sys/auth" {
   capabilities = ["read"]
 }
 
-# Enable and manage the key/value secrets engine at `secret/` path
-
-# List, create, update, and delete key/value secrets
-# path "secret/*"
-# {
-#   capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-# }
-
 # Manage secrets engines
 path "sys/mounts/*" {
   capabilities = ["create", "read", "update", "delete", "list", "sudo"]

policies/identity_admin_policy.hcl

@@ -1,8 +1,13 @@
 # Add identity admin role to the token
 path "identity/*" {
-  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+  capabilities = ["create", "read", "update", "delete", "list"]
 }
 
-path "identity/entity/*/name" {
+# Override default policies for identity management
-  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+path "identity/entity/id/{{identity.entity.id}}" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "identity/entity/name/{{identity.entity.name}}" {
+  capabilities = ["create", "read", "update", "delete", "list"]
 }