coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in issuer-owned access-token status and scoped revocation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
This commit is contained in:
tegwick 2026-10-18 10:10:38 +02:00
parent d803e9282a
commit 67a0869c1e
18 changed files with 1230 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/operations.md
View file

@ -20,7 +20,8 @@ is not required today.
Consequences to plan for:
- **A restart drops in-flight logins.** Anyone mid-login gets an error and must
start again. Issued tokens are unaffected — they are self-contained JWTs and
start again. In the default profile issued tokens are unaffected — they are
self-contained JWTs and
stay valid until they expire.
- **Rolling deployments are single-instance rollovers**, so expect a brief window
where new logins fail. Draining (below) protects requests already in flight, not
@ -89,7 +90,8 @@ and reject freshly issued tokens until its cache expires. Plan rotation as
a same-`kid` swap as a breaking change for anyone caching aggressively.
**Removing a client registration does not revoke tokens already issued to it.**
There is no introspection or revocation endpoint, so an issued token stays valid
In the default expiry-only profile there is no introspection or revocation
endpoint, so an issued token stays valid
until it expires — 15 minutes by default, or the client's `tokenLifetime`. To cut
off a compromised client, remove the registration *and* wait out the lifetime, or
rotate the signing key if you cannot.
@ -281,3 +283,12 @@ set with net-kingdom `sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py`;
`--operation remove` plus a restart is the rollback. A redirect URI that is not http(s)
skips the page. Every `auth_success` log line now carries `client_id`, `uid` and
`assurance`, and no token, code, email or one-time password.
## Proposed online token-status profile
KEY-WP-0042 adds an explicitly enabled singleton profile. It makes prior tokens
inactive at online endpoints after restart and keeps revoked-token tombstones
until expiry. It does not revoke offline consumers or upstream/browser sessions.
Read [the complete lifecycle and admission contract](online-token-status.md)
before proposing activation; no image/config rollout or consumer admission is
established by source tests. Existing deployed configuration remains unchanged.