101 lines
3.2 KiB
Markdown
101 lines
3.2 KiB
Markdown
---
|
|
id: KEY-WP-0006
|
|
type: workplan
|
|
title: "Client credentials and service-token issuance"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-07-27"
|
|
updated: "2026-07-27"
|
|
state_hub_workstream_id: "f2d5df23-9dd2-4995-b218-be5904e07508"
|
|
---
|
|
|
|
# KEY-WP-0006 - Client credentials and service tokens
|
|
|
|
Implement the missing service-principal half of the IAM Profile so
|
|
`KEY-WP-0004` can issue a least-privilege identity to `rapp-qonto`.
|
|
|
|
## T01 - Model confidential service clients
|
|
|
|
```task
|
|
id: KEY-WP-0006-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "4e7addc2-5773-499f-84e4-ffddc1800952"
|
|
```
|
|
|
|
Extend static client registration with an explicit service subject, tenant,
|
|
roles, and an environment-backed secret reference. Refuse startup when a
|
|
`client_credentials` client is public, lacks its identity fields, or cannot
|
|
resolve its secret. Never serialize or log the resolved secret.
|
|
|
|
2026-07-27: Added explicit service subject, tenant, roles, and in-memory-only
|
|
resolved secret fields. Configuration validation rejects public or incomplete
|
|
service clients, and startup resolves only `env:` secret references while
|
|
reporting the variable name—not its value—on failure.
|
|
|
|
## T02 - Implement secure client_credentials exchange
|
|
|
|
```task
|
|
id: KEY-WP-0006-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "9fd408dc-6f71-4765-ace2-22ee7bb1cf57"
|
|
```
|
|
|
|
Accept confidential client authentication through HTTP Basic, compare secrets
|
|
in constant time, restrict requested scopes to the registered allowlist, and
|
|
issue a short-lived access token with `principal_type=service`,
|
|
tenant-specific subject/roles, empty groups, `aal1` client-secret assurance,
|
|
and optional cached `tenant_roles`. Do not issue an ID token for this
|
|
non-human grant.
|
|
|
|
2026-07-27: Implemented HTTP Basic confidential-client authentication with
|
|
fixed-length SHA-256 constant-time comparison, allowlisted scopes, short-lived
|
|
service claims, optional tenant-role cache, token-issued telemetry, and no ID
|
|
token.
|
|
|
|
## T03 - Prove positive and negative conformance
|
|
|
|
```task
|
|
id: KEY-WP-0006-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e37a346b-f6bc-4b29-9c13-94ec1c79a381"
|
|
```
|
|
|
|
Cover valid exchange, unknown client, public client, missing/wrong secret,
|
|
unsupported grant, excess scope, tenant isolation, telemetry redaction, and
|
|
discovery metadata. Run the full Go build, vet, and test suite.
|
|
|
|
2026-07-27: Added positive service-claim and negative wrong-secret/excess-scope
|
|
tests, updated discovery to advertise only implemented grants/auth methods,
|
|
and verified `go test ./...`, `go vet ./...`, and `go build ./...` across the
|
|
module.
|
|
|
|
## T04 - Provision and verify rapp-qonto
|
|
|
|
```task
|
|
id: KEY-WP-0006-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "ba65d39f-63b8-42aa-87bb-99ec26821a8e"
|
|
```
|
|
|
|
Generate the client secret without disclosure, store it through the approved
|
|
OpenBao lane, register the static `rapp-qonto` client, deploy KeyCape, and
|
|
verify a real exchange yields only the documented Binky service claims.
|
|
Publish non-secret evidence to `KEY-WP-0004-T03` through T05.
|
|
|
|
## T05 - Closure review
|
|
|
|
```task
|
|
id: KEY-WP-0006-T05
|
|
status: wait
|
|
priority: low
|
|
state_hub_task_id: "7c9cdac6-c53f-4a32-81d2-8d2e73de0039"
|
|
```
|
|
|
|
Close after T01-T04 pass and the repeatable verification path is documented.
|