108 lines
4.4 KiB
YAML
108 lines
4.4 KiB
YAML
|
apiVersion: netkingdom.io/playbook-capability/v0.1
|
||
|
|
kind: PlaybookCapabilityDeclaration
|
||
|
|
metadata:
|
||
|
|
id: key-cape.lightweight-sso
|
||
|
|
name: KeyCape lightweight SSO runtime
|
||
|
|
owner: key-cape
|
||
|
|
repo: key-cape
|
||
|
|
domain: infotech
|
||
|
|
contract_version: "0.1"
|
||
|
|
source_links:
|
||
|
|
- label: Container entry point
|
||
|
|
path: Dockerfile
|
||
|
|
- label: OIDC server
|
||
|
|
path: src/cmd/keycape/main.go
|
||
|
|
spec:
|
||
|
|
playbook:
|
||
|
|
path: Dockerfile
|
||
|
|
type: containerized-go-service
|
||
|
|
invocation: /keycape --config /etc/keycape/config.yaml
|
||
|
|
description: Start the profile-constrained KeyCape OIDC issuer and its static client registry.
|
||
|
|
capabilities:
|
||
|
|
- id: c1.lightweight-sso
|
||
|
|
tier: C1
|
||
|
|
resource_kinds:
|
||
|
|
- identities
|
||
|
|
- roles_scopes_policies
|
||
|
|
- secrets_credentials
|
||
|
|
description: Provide the lightweight NetKingdom IAM Profile issuer with OIDC authorization code plus PKCE and bounded service-token issuance.
|
||
|
|
parameters:
|
||
|
|
- name: config_path
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: /etc/keycape/config.yaml
|
||
|
|
sensitivity: secret_reference
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Mounted KeyCape configuration path; secret values remain in the owning delivery system.
|
||
|
|
- name: issuer
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: https://kc.coulomb.social
|
||
|
|
constraints:
|
||
|
|
pattern: ^https://[^\n\r]+$
|
||
|
|
sensitivity: security_sensitive
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Exact issuer used in discovery and every signed token.
|
||
|
|
- name: default_token_lifetime
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: 15m
|
||
|
|
constraints:
|
||
|
|
pattern: ^[1-9][0-9]*[smh]$
|
||
|
|
sensitivity: security_sensitive
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Server default token lifetime; confidential clients may declare a shorter bounded lifetime.
|
||
|
|
- name: signing_key_path
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: /etc/keycape/key.pem
|
||
|
|
sensitivity: secret_reference
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Mounted RS256 signing-key path; the declaration never carries key material.
|
||
|
|
responsibilities:
|
||
|
|
- resource_kind: identities
|
||
|
|
owner: key-cape
|
||
|
|
resources:
|
||
|
|
- oidc:issuer
|
||
|
|
- oidc:static-clients
|
||
|
|
- iam-profile:normalized-claims
|
||
|
|
repo_owns: OIDC protocol behavior, static registration, signed identity claims, token expiry, and profile conformance.
|
||
|
|
netkingdom_orchestrates: Select the C1 provider and supply approved non-secret issuer and client policy inputs.
|
||
|
|
- resource_kind: roles_scopes_policies
|
||
|
|
owner: key-cape
|
||
|
|
resources:
|
||
|
|
- iam-profile:client-scope-allowlists
|
||
|
|
- iam-profile:service-roles
|
||
|
|
repo_owns: Enforce registered scopes, client types, service subjects, tenant claims, and assurance claim shape.
|
||
|
|
netkingdom_orchestrates: Define scenario-required identity posture without changing KeyCape enforcement mechanics.
|
||
|
|
- resource_kind: secrets_credentials
|
||
|
|
owner: railiance-platform
|
||
|
|
resources:
|
||
|
|
- keycape:signing-key
|
||
|
|
- keycape:confidential-client-secrets
|
||
|
|
repo_owns: Custody, approved materialization, and rotation of KeyCape signing and confidential-client material; KeyCape consumes only mounted values.
|
||
|
|
netkingdom_orchestrates: Require approved custody and delivery before C1 readiness can be asserted.
|
||
|
|
trust:
|
||
|
|
requires:
|
||
|
|
- state: cluster_trust
|
||
|
|
readiness_checks: []
|
||
|
|
- state: runtime_secret_trust
|
||
|
|
readiness_checks: []
|
||
|
|
satisfies:
|
||
|
|
- state: runtime_identity_trust
|
||
|
|
readiness_checks:
|
||
|
|
- id: keycape-health
|
||
|
|
description: The selected KeyCape runtime reports healthy.
|
||
|
|
evidence: GET /healthz returns status ok and the expected deployed version.
|
||
|
|
- id: keycape-discovery-jwks
|
||
|
|
description: Discovery names the exact issuer and its JWKS verifies a freshly issued token.
|
||
|
|
evidence: /.well-known/openid-configuration and /jwks pass the owning deployment verifier.
|
||
|
|
- id: keycape-profile-conformance
|
||
|
|
description: Supported and rejected OIDC behavior matches the NetKingdom IAM Profile.
|
||
|
|
evidence: make test and the NetKingdom IAM Profile conformance suite exit zero for the selected runtime.
|
||
|
|
catalog:
|
||
|
|
publish: capabilities/playbooks/key-cape.lightweight-sso.yaml
|
||
|
|
maturity: implemented
|
||
|
|
consumers:
|
||
|
|
- netkingdom-security-scenario-composer
|