diff --git a/CHANGELOG.md b/CHANGELOG.md
index f2f60e2..2958697 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ##  [2.4.0] Unreleased
 
 ### Added
+  - Federated login for multiple instances.  Defaults to using Hashicorp Vault for secret management.
 
 ### Changed
 
diff --git a/docs/authn.rst b/docs/authn.rst
index c45f4a2..010dc0e 100644
--- a/docs/authn.rst
+++ b/docs/authn.rst
@@ -141,3 +141,41 @@ Authenticating
 Once the client side authentication is setup, you should be able to trigger the authentication process with ``!session_start my_secret_word`` which will return a url to complete the login processes. This is how the page looks like:
 
 .. image:: images/authentication_screen.jpg
+
+
+Federated authentication
+------------------------------------------------------------------------
+
+This feature is experimental and may not be suitable for all enviornments that would like to use such a feature.
+
+The federated authentication is intended for use when independent instances of StackStorm are run with an err-stackstorm instance attached to each one.
+
+This creates a problem when users must identify per st2 instance if they want to run an action-alias.  To enable scaling the login process, a remote authentication end point is added to err-stackstorm.  The endpoint recieves notifications when a chat user successfully authenticates.  The receiving err-stackstorm instance, will query a fixed path in the secret store to retreive a one time use token, that will give access to the credentials which will be used to authenticate against the local st2 api instance.
+
+`unwrap_path` string can have a token `{federation_id}` that will be resolved to the id defined in the list of federated peers.
+
+Currently, only vault is supported as a secret backend.
+
+```
+    "secrets_backend": {
+        "vault": {
+            "url": "https://vault.example.com",
+            "auth": {
+                "token": "a.bdcdeed",
+                "approle": {
+                    "role_id": "123456",
+                    "secret_id": "456789"
+                }
+            },
+            "unwrap_path": "/kv/{federation_id}/err-stackstorm/remote-auth"
+        }
+    },
+    "federation":{
+        "id": "dc2",
+        "peers": {
+            "dc1": {
+                "api": "https://st2.dc1.example.com/"
+            }
+        }
+    },
+```
diff --git a/pyproject.toml b/pyproject.toml
index a043d06..8098ccb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "err-stackstorm"
-version = "2.3.2"
+version = "2.4.0"
 authors = [{ name="Err-stackstorm maintainers", email="nzlosh@yahoo.com" }]
 keywords = [
     "errbot",
@@ -28,6 +28,7 @@ dependencies = [
     "requests>=2.20.0",
     "sseclient",
     "jsonschema",
+    "hvac",
 ]
 
 [project.urls]
diff --git a/src/err-stackstorm/errst2lib/chat_adapters.py b/src/err-stackstorm/errst2lib/chat_adapters.py
index a4cdfcb..ef3b336 100644
--- a/src/err-stackstorm/errst2lib/chat_adapters.py
+++ b/src/err-stackstorm/errst2lib/chat_adapters.py
@@ -472,3 +472,19 @@ def get_username(self, msg):
         else:
             name = f"@{username}"
         return name
+
+    def normalise_user_id(self, user):
+        return str(user.aclattr)
+
+    def present_sessions(self, sessions):
+        res = "**Sessions**:\n"
+        for session in sessions:
+            userid = session.attributes()["UserID"]
+            if session.attributes().get("UserID") == "errbot%service":
+                res += "- {}\n".format(str(session))
+            else:
+                user = self.bot_plugin.build_identifier(
+                    "<@{}>".format(session.attributes().get("UserID"))
+                )
+                res += "- `{}` `{}`\n".format(user.person, str(session))
+        return res
diff --git a/src/err-stackstorm/errst2lib/config.py b/src/err-stackstorm/errst2lib/config.py
index 9857a28..c035d5f 100644
--- a/src/err-stackstorm/errst2lib/config.py
+++ b/src/err-stackstorm/errst2lib/config.py
@@ -3,6 +3,7 @@
 
 from errst2lib.authentication_handler import AuthHandlerFactory
 from errst2lib.credentials_adapters import CredentialsFactory
+from errst2lib.secrets_adapters import SecretsAdapterFactory
 
 LOG = logging.getLogger(__name__)
 
@@ -38,6 +39,9 @@ def setup(self, bot_conf):
         self._configure_credentials(bot_conf)
         self._configure_rbac_auth(bot_conf)
         self._configure_stackstorm(bot_conf)
+        self._configure_secret_backend(bot_conf.STACKSTORM.get("secrets_backend", {}))
+        self._configure_federated_authentication(bot_conf.STACKSTORM.get("federation", {}))
+
         self.oob_auth_url = bot_conf.STACKSTORM.get("oob_auth_url", "https://localhost:8888/")
         self.timer_update = bot_conf.STACKSTORM.get("timer_update", 60)
         self.verify_cert = bot_conf.STACKSTORM.get("verify_cert", True)
@@ -96,3 +100,29 @@ def _configure_credentials(self, bot_conf):
             LOG.warning(
                 "Failed to find any valid st2 credentials for the bot,  check configuration file."
             )
+
+    def _configure_secret_backend(self, bot_conf):
+        """
+        Get the secret definition.
+        """
+        secret_backend = list(bot_conf.keys())
+        LOG.debug("Secrets backend %s", secret_backend)
+        if len(secret_backend) == 0:
+            LOG.warning(
+                "Unable to configure secrets backend.  'secrets_backend' "
+                "not found in config or no backend defined."
+            )
+        elif len(secret_backend) > 1:
+            LOG.warning(
+                "Only one secret backend definition is supported, "
+                "multiple secret backends have been detected."
+            )
+        else:
+            self.secret_backend = secret_backend[0]
+            self.secret_backend_cfg = bot_conf[self.secret_backend]
+
+    def _configure_federated_authentication(self, bot_conf):
+        """
+        Configuration for Federated authentication.
+        """
+        self.federation = bot_conf
diff --git a/src/err-stackstorm/errst2lib/secrets_adapters.py b/src/err-stackstorm/errst2lib/secrets_adapters.py
new file mode 100644
index 0000000..09f74ca
--- /dev/null
+++ b/src/err-stackstorm/errst2lib/secrets_adapters.py
@@ -0,0 +1,168 @@
+# coding:utf-8
+import abc
+import logging
+
+try:
+    import hvac
+
+    HAVE_HVAC = True
+except ModuleNotFoundError:
+    HAVE_HVAC = False
+
+LOG = logging.getLogger(__name__)
+
+
+class AbstractSecretsAdapterFactory(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def instantiate(store_type):
+        raise NotImplementedError
+
+
+class SecretsAdapterFactory(AbstractSecretsAdapterFactory):
+    @staticmethod
+    def instantiate(store_type):
+        LOG.debug("Establish connection with secret store service. '{}'".format(store_type))
+        return {"vault": VaultSecretsAdapter}.get(store_type, NoOpSecretsAdapter)
+
+
+class AbstractSecretsAdapter(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def setup(self, cfg):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def wrap_secret(self, secret, ttl):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def unwrap(self, token):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def read_kv(self, path, mount_point):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def write_kv(self, k, v, mount_point):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def renew_token(self):
+        raise NotImplementedError
+
+    @abc.abstractmethod
+    def teardown(self):
+        raise NotImplementedError
+
+
+class NoOpSecretsAdapter(AbstractSecretsAdapter):
+    """
+    No Op Secret Adapater does nothing.
+    """
+
+    def setup(self):
+        pass
+
+    def renew_token(self):
+        pass
+
+    def wrap_secret(self, secret, ttl):
+        pass
+
+    def unwrap(self, token):
+        pass
+
+    def read_kv(self, path, mount_point):
+        pass
+
+    def write_kv(self, k, v, mount_point):
+        pass
+
+    def teardown(self):
+        pass
+
+
+class VaultSecretsAdapter(AbstractSecretsAdapter):
+    """
+    Vault secrets store.  kv read/write/list and wrap/unwrap.
+    """
+
+    def __init__(self, cfg):
+        self.client = None
+        self.unwrap_path = None
+        self.cfg = cfg
+
+    def setup(self):
+        if not HAVE_HVAC:
+            LOG.warning(
+                "hvac module could not be found.  The Vault Secrets "
+                "adapter can't function without it."
+            )
+            return
+        self.client = hvac.Client(url=self.cfg["url"])
+        self.unwrap_path = self.cfg["unwrap_path"]
+
+        # supported credentials are token or approle.
+        token = self.cfg.get("auth", {}).get("token")
+        if "token" in self.cfg["auth"]:
+            LOG.debug("Vault authentication using Token")
+            self.client.token = self.cfg["auth"]["token"]
+        elif "approle" in self.cfg["auth"]:
+            LOG.debug("Vault authentication using AppRole")
+            self.client.auth.approle.login(
+                role_id=self.cfg["auth"]["approle"].get("role_id"),
+                secret_id=self.cfg["auth"]["approle"].get("secret_id"),
+            )
+        else:
+            raise RuntimeError(
+                "Vault Secret backend only supports token or approle authentication."
+            )
+        LOG.info("Vault token is authenticated = %s", self.client.is_authenticated())
+
+    def renew_token(self, threshold=3600):
+        """
+        threshold: the minimum number of seconds remaining to request a token.
+        """
+        # to do, add threshold check
+        if True:
+            self.teardown()
+            self.setup()
+
+    def get_wrap_path(self):
+        return self.unwrap_path
+
+    def wrap_secret(self, secret, ttl=30):
+        """
+        Given a secret and the path
+        """
+        return self.client.sys.wrap(payload=secret, ttl=ttl)
+
+    def unwrap(self, token):
+        """
+        Given a chat userid, fetch an unwrap token from unwrap_path and perform the unwrap procedure
+        to return the secret contents.
+        """
+        return self.client.sys.unwrap(token)
+
+    def read_kv(self, path, mount_point="kv"):
+        """
+        Read a vault secret from kv path.
+        """
+        return self.client.secrets.kv.v1.read_secret(
+            path=path,
+            mount_point=mount_point,
+        )["data"]
+
+    def write_kv(self, k, v, mount_point="kv"):
+        """
+        Write a vault secret to the kv path.
+        """
+        self.client.secrets.kv.v1.create_or_update_secret(k, secret=v, mount_point="kv")
+
+    def teardown(self):
+        """
+        Close connection with secrets backend.
+        """
+        if self.client:
+            self.client.logout()
+            self.client = None
diff --git a/src/err-stackstorm/errst2lib/session.py b/src/err-stackstorm/errst2lib/session.py
index fcfe870..b3cbed2 100644
--- a/src/err-stackstorm/errst2lib/session.py
+++ b/src/err-stackstorm/errst2lib/session.py
@@ -23,7 +23,7 @@ def __init__(self, user_id, user_secret, session_ttl=3600):
         self.bot_secret = None
         self.user_id = user_id
         self._is_sealed = True
-        self.session_id = uuid.uuid4()
+        self.session_id = str(uuid.uuid4())
         self.create_date = int(dt.now().timestamp())
         self.modified_date = self.create_date
         self.ttl_in_seconds = session_ttl
diff --git a/src/err-stackstorm/errst2lib/store_adapters.py b/src/err-stackstorm/errst2lib/store_adapters.py
index af568d9..c125d08 100644
--- a/src/err-stackstorm/errst2lib/store_adapters.py
+++ b/src/err-stackstorm/errst2lib/store_adapters.py
@@ -1,5 +1,6 @@
 # coding:utf-8
 import abc
+import hashlib
 import logging
 
 LOG = logging.getLogger(__name__)
@@ -115,8 +116,16 @@ def put_by_id(self, session_id, session):
             self.id_to_user_map[session_id] = session.user_id
 
     def get_by_uuid(self, session_id):
+        """
+        Return a session given its UUID.
+        Return False if the session id is not found.
+        """
         user_id = self.id_to_user_map.get(session_id, False)
+        if user_id is False:
+            LOG.debug("Error: Session id '{}' doesn't exist in user mapping.".format(session_id))
+
         session = self.memory.get(user_id, False)
         if session is False:
-            LOG.debug("Error: Session id '{}' points to a missing session.".format(""))
+            LOG.debug("Error: User id '{}' doesn't exist.".format(user_id))
+
         return session
diff --git a/src/err-stackstorm/errst2lib/version.py b/src/err-stackstorm/errst2lib/version.py
index ea16adc..f463f49 100644
--- a/src/err-stackstorm/errst2lib/version.py
+++ b/src/err-stackstorm/errst2lib/version.py
@@ -1 +1 @@
-ERR_STACKSTORM_VERSION = "2.3.2"
+ERR_STACKSTORM_VERSION = "2.4.0"
diff --git a/src/err-stackstorm/html/index.html b/src/err-stackstorm/html/index.html
index aa786ff..a608de0 100644
--- a/src/err-stackstorm/html/index.html
+++ b/src/err-stackstorm/html/index.html
@@ -6,7 +6,7 @@
     <script src="https://cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.3.3/semantic.min.js"></script>
     <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-serialize-object/2.5.0/jquery.serialize-object.min.js"></script>
     <script>
-        console.log("err-stackstorm v2.3.2")
+        console.log("err-stackstorm v2.4.0")
         function get_uuid_from_querystring() {
             uuid = undefined;
             params = window.location.href.split("?");
diff --git a/src/err-stackstorm/st2.py b/src/err-stackstorm/st2.py
index 8e0e9d7..5eb7d79 100644
--- a/src/err-stackstorm/st2.py
+++ b/src/err-stackstorm/st2.py
@@ -1,17 +1,19 @@
 # coding:utf-8
 import json
 import logging
+import requests
 import shlex
 import threading
 import traceback
+import uuid
 from types import SimpleNamespace
 
-import requests
 from errbot import BotPlugin, Command, arg_botcmd, botcmd, re_botcmd, webhook
 
 from errst2lib.authentication_controller import AuthenticationController, BotPluginIdentity
 from errst2lib.authentication_handler import AuthHandlerFactory, ClientSideAuthHandler
 from errst2lib.chat_adapters import ChatAdapterFactory
+from errst2lib.secrets_adapters import SecretsAdapterFactory
 from errst2lib.config import PluginConfiguration
 from errst2lib.credentials_adapters import St2ApiKey, St2UserCredentials, St2UserToken
 from errst2lib.enquiry import Enquiry, EnquiryManager
@@ -43,9 +45,15 @@ def __init__(self, bot, name):
         except Exception as err:
             LOG.critical(
                 "Errors were encountered processing the STACKSTORM configuration."
-                "Please correct the errors and restart the bot."
-                "{}".format(err)
+                "  Please correct the errors and restart the bot.  %s",
+                err,
             )
+            return
+
+        self.secrets = SecretsAdapterFactory.instantiate(self.cfg.secret_backend)(
+            self.cfg.secret_backend_cfg
+        )
+        self.secrets.setup()
 
         # The chat backend adapter mediates data format and api calls between
         # stackstorm, errbot and the chat backend.
@@ -68,7 +76,6 @@ def authenticate_bot_credentials(self):
         """
         Create a session and associate valid StackStorm credentials with it for the bot to use.
         """
-
         # Create a session for internal use by err-stackstorm
         try:
             bot_session = self.accessctl.create_session(
@@ -152,21 +159,40 @@ def session_list(self, msg, args):
         """
         return self.chatbackend.present_sessions(self.accessctl.list_sessions())
 
-    def session_delete(self, msg, args):
+    def session_end(self, msg, args):
         """
-        Delete an established session.
+        User triggered end of an established session. (for users to end their session)
         """
-        if len(args) > 0:
-            self.accessctl.delete_session(args)
+        userid = msg.frm
+        LOG.debug("End session for '%s'", userid)
+        session = self.accessctl.get_session(userid)
+        if session:
+            session_id = session.session_id
+        else:
+            session_id = session
+        # delete user session
+        self.accessctl.delete_session(session_id)
+        return f"Session ID {session_id} for {userid} has been removed."
 
-    def session_disconnect(self, msg, args):
+    def session_cancel(self, msg, args):
         """
-        Usage: session_disconnect
+        Usage: session_cancel <userid> (for admins to end user session)
         Closes the session.  StackStorm credentials are purged when the session is closed.
         """
-        # get user session
-        # delete user session
-        return "Not implemented yet."
+        if len(args) != 0:
+            userid = args
+            LOG.debug("Cancel session for '%s'", userid)
+            session = self.accessctl.get_session(userid)
+        else:
+            return "Chat user is required to cancel session."
+
+        if session:
+            session_id = session.session_id
+            # delete user session
+            self.accessctl.delete_session(session_id)
+            return f"Session ID {session_id} for {userid} has been removed."
+        else:
+            return f"Failed to find a session for {userid}"
 
     def enquiry_list(self, msg, args):
         """
@@ -420,10 +446,76 @@ def chatops_message(self, request):
         self.chatbackend.post_message(whisper, message, user, channel, extra)
         return "Delivered to chat backend."
 
+    @webhook("/login/remote-authenticate/<userid>")
+    def remote_login_auth(self, request, userid):
+        """
+        Remote Login Authentication is a end point used to receive login events from federated
+        err-stackstorm instances.  No sensitive data is received by the end point, however a
+        secret store (Vault) is used to share the credentials between instances.
+        """
+        LOG.info("Remote Login Authentication called for %s", userid)
+
+        if not self.cfg.federation:
+            LOG.warning(
+                "Received a remote login request for a non-federated err-stackstorm instance."
+            )
+            return
+
+        if not self.secrets:
+            LOG.warning(
+                "Received a remote login request for a federated"
+                "err-stackstorm instance without a secret backend."
+            )
+            return
+        self.secrets.renew_token()
+
+        unwrap_path = self.secrets.get_wrap_path().format(federation_id=self.cfg.federation["id"])
+        unwrap_path = f"{unwrap_path}/{userid}"
+        LOG.debug("Unwrap path %s", unwrap_path)
+
+        token = self.secrets.read_kv(unwrap_path)["token"]
+        credentials = self.secrets.unwrap(token)["data"]
+
+        try:
+            session = self.accessctl.get_session(userid)
+            self.accessctl.delete_session(session.session_id)
+        except SessionInvalidError:
+            LOG.debug("No session exist, create a new one.")
+            pass
+
+        # Create or renew session for user.
+        shared_secret = str(uuid.uuid4())
+        session = self.accessctl.create_session(userid, shared_secret)
+        LOG.debug("Session %s created for %s", session.session_id, userid)
+        # Consume the session since it's a non-interactive, login.
+        self.accessctl.consume_session(session.session_id)
+
+        if self.accessctl.associate_credentials(
+            userid,
+            St2UserCredentials(credentials["username"], credentials["password"]),
+            self.cfg.bot_creds,
+        ):
+            LOG.info("StackStorm credentials association succeeded.")
+        else:
+            LOG.info("StackStorm credentials association failed.")
+
     @webhook("/login/authenticate/<uuid>")
     def login_auth(self, request, uuid):
-        # WARNING: Sensitive security information will be logged, uncomment only when necessary.
-        # LOG.debug("Request: {}".format(request))
+        """
+        Login route to authenticate StackStorm credentials.
+        The errbot Webserver plugin must be active and configured.  For example:
+        !plugin config Webserver {
+          "HOST": "0.0.0.0",
+          "PORT": 3141,
+          "SSL": {
+            "enabled": False,
+            "host": "0.0.0.0",
+            "port": 3142,
+            "certificate": "",
+            "key": ""
+          }
+        }
+        """
         r = SimpleNamespace(
             **{
                 "authenticated": False,
@@ -454,7 +546,7 @@ def login_auth(self, request, uuid):
         if r.return_code == 0:
             # Get the user associated with the session id.
             user = self.accessctl.get_session_userid(uuid)
-            LOG.debug("Matched chat user {} for credential association".format(user))
+
             if "username" in request:
                 username = request.get("username", "")
                 password = request.get("password", "")
@@ -462,6 +554,43 @@ def login_auth(self, request, uuid):
                     user, St2UserCredentials(username, password), self.cfg.bot_creds
                 ):
                     r.authenticated = True
+
+                    # Federated mode: notify peers to perform remote login.
+                    if self.secrets and self.cfg.federation:
+                        for peer_id, peer_data in self.cfg.federation["peers"].items():
+                            try:
+                                wrap_data = self.secrets.wrap_secret(
+                                    {"username": username, "password": password}
+                                )
+                                token = wrap_data.get("wrap_info", {}).get("token")
+                                # WARNING: uncomment the log below will leak sensitive info!
+                                # LOG.debug("unwrap token %s", token)
+                                secret_path = self.secrets.get_wrap_path().format(
+                                    federation_id=peer_id
+                                )
+                                secret_path = f"{secret_path}/{user}"
+                                self.secrets.write_kv(secret_path, {"token": token})
+                                notify_url = "{}/login/remote-authenticate/{}".format(
+                                    peer_data["api"]["url"], user
+                                )
+                                LOG.debug(
+                                    "Sending remote login notification for %s for %s at %s",
+                                    user,
+                                    peer_id,
+                                    notify_url,
+                                )
+                                headers = {"X-ErrStackStorm-Token": peer_data["api"]["token"]}
+                                notify_res = requests.get(notify_url, headers=headers, timeout=5)
+                                LOG.debug("HTTP notification returned %s", notify_res)
+                            except Exception as e:
+                                LOG.warning("Error notifying %s: %s", peer_id, str(e))
+                    else:
+                        LOG.debug(
+                            "Remote login unavailable.  secret cfg avilable: %s,"
+                            " federation cfg available: %s",
+                            bool(self.secrets),
+                            bool(self.cfg.federation),
+                        )
                 else:
                     r.message = "Invalid credentials"
                     r.return_code = 6
@@ -471,6 +600,9 @@ def login_auth(self, request, uuid):
                     user, St2UserToken(user_token), self.cfg.bot_creds
                 ):
                     r.authenticated = True
+                    # Federated mode: notify peers to perform remote login.
+                    if self.secrets and self.federation:
+                        raise NotImplementedError
                 else:
                     r.message = "Invalid token"
                     r.return_code = 6
@@ -480,6 +612,9 @@ def login_auth(self, request, uuid):
                     user, St2ApiKey(api_key), self.cfg.bot_creds
                 ):
                     r.authenticated = True
+                    # Federated mode: notify peers to perform remote login.
+                    if self.secrets and self.federation:
+                        raise NotImplementedError
                 else:
                     r.message = "Invalid api key"
                     r.return_code = 6
@@ -548,14 +683,14 @@ def enquiry_reply(plugin, msg, args):
                     "chat service and StackStorm API.",
                 ),
                 Command(
-                    lambda plugin, msg, args: self.session_delete(msg, args),
+                    lambda plugin, msg, args: self.session_cancel(msg, args),
                     name=f"{self.cfg.plugin_prefix}session_cancel",
                     cmd_type=botcmd,
                     cmd_kwargs={"admin_only": True},
                     doc="Allow an administrator to cancel a users session.",
                 ),
                 Command(
-                    lambda plugin, msg, args: self.session_disconnect(msg, args),
+                    lambda plugin, msg, args: self.session_end(msg, args),
                     name="{}session_end".format(self.cfg.plugin_prefix),
                     cmd_type=botcmd,
                     cmd_kwargs={"admin_only": False},