coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

KEY-WP-0046: directory bind password from KEYCAPE_LLDAP_BIND_PW
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details

Browse source 
config.Load uses the variable when lldap.bindPW is empty, accepts equal
values (migration, logged as redundant) and refuses differing values with an
error that names neither. check-config and identity-facts report the source,
never the value. For net-kingdom NK-WP-0056-T04 (ESO-delivered svc-keycape bind).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
tegwick 2026-10-31 10:24:22 +01:00
parent a1ab8ff807
commit e2b5fa1442
8 changed files with 160 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

49
workplans/KEY-WP-0046-directory-bind-password-env.md Normal file
View file

@ -0,0 +1,49 @@
---
id: KEY-WP-0046
type: workplan
title: "Directory bind password from the environment (KEYCAPE_LLDAP_BIND_PW)"
domain: infotech
repo: key-cape
status: active
owner: claude-code
topic_slug: custodian
created: "2026-10-31"
updated: "2026-10-31"
flavor: extension
depends_on: []
---
Accepted from net-kingdom NK-WP-0056-T04 (founder decision 2026-10-31: environment override, implemented by
claude-code in this repository). NetKingdom moves the LLDAP service binds from personal custody into OpenBao,
delivered by ESO. KeyCape reads `lldap.bindPW` only from `config.yaml` inside the `keycape-config` Secret, so
ESO cannot own that one value. With an environment override the bind is delivered from a dedicated Secret
key, as client secrets already are (`secretRef: env:...`).
## Accept KEYCAPE_LLDAP_BIND_PW in config.Load
```task
id: KEY-WP-0046-T01
status: done
priority: high
```
`config.Load` applies `KEYCAPE_LLDAP_BIND_PW` (the name `lldap-export` already reads): used when `bindPW` is
empty; accepted with a warning when equal to `bindPW` (migration state); startup refused when they differ,
with an error that names neither value. `Config.LLDAPBindPWSource` records the source; `check-config` reports
`lldap_bind_pw_source` and `identity-facts` reports `password_source`. Tests in
`src/internal/config/config_test.go`; `docs/operations.md` documents the variable.
**Done when:** the change is merged with tests and `go vet`/`go test ./...` pass.
## Image through the owner pipeline
```task
id: KEY-WP-0046-T02
status: todo
priority: high
```
The Forgejo workflow builds the image from `main`. Record the digest here and in net-kingdom NK-WP-0056-T04;
net-kingdom pins it in `sso-mfa/k8s/keycape/deployment.yaml` together with the new environment entry.
**Done when:** an image built from a commit containing T01 is published, and its digest is recorded.