coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

KEY-WP-0046: directory bind password from KEYCAPE_LLDAP_BIND_PW
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details

Browse source 
config.Load uses the variable when lldap.bindPW is empty, accepts equal
values (migration, logged as redundant) and refuses differing values with an
error that names neither. check-config and identity-facts report the source,
never the value. For net-kingdom NK-WP-0056-T04 (ESO-delivered svc-keycape bind).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
tegwick 2026-10-31 10:24:22 +01:00
parent a1ab8ff807
commit e2b5fa1442
8 changed files with 160 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/operations.md
View file

@ -249,6 +249,16 @@ No resource-efficiency or throughput bounds are asserted here. Nothing in this
repository benchmarks KeyCape, so any figure would be invention. Measure it in
your own deployment before sizing against it.
## Directory bind password from the environment
`KEYCAPE_LLDAP_BIND_PW` supplies the LLDAP bind password, so a deployment can deliver
it from its own Secret key (`valueFrom.secretKeyRef`) instead of `lldap.bindPW` in
`config.yaml`. If only the variable is set it is used. If both are set they must be
equal (the migration state; the server logs that `bindPW` is redundant); different
values refuse startup, and the error names neither value. `keycape check-config` reports
`lldap_bind_pw_source` (`config`, `env`, `env-and-config` or empty) and
`keycape identity-facts` reports `password_source`. Neither command prints the value.
## Account recovery and browser sign-out
Set `KEYCAPE_ACCOUNT_PORTAL_URL=https://users.coulomb.social` and