coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire bao.coulomb.social callbacks from the KeyCape openbao-admin client
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
The name was retired on 2026-09-15. Remove both public UI callbacks from
the code-defined client (openbao-client-config.py, create-secrets.sh), stop
probing them in verify-openbao-client.sh, and fail verification in
openbao-client-config.py and verify-t07.sh if either is registered again.
The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:41:35 +02:00
parent a356f640ac
commit 3b14469afb
6 changed files with 51 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

20
sso-mfa/k8s/keycape/openbao-client-config.py
View file

@ -31,14 +31,18 @@ OPENBAO_CLIENT = {
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
],
"allowedScopes": ["openid", "profile", "email", "groups"],
"grantTypes": ["authorization_code"],
"clientType": "public",
}
# bao.coulomb.social was retired on 2026-09-15; its callbacks must not return.
RETIRED_OPENBAO_REDIRECT_URIS = (
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
)
RAPP_QONTO_CLIENT = {
"clientId": "rapp-qonto-client",
"displayName": "rapp-qonto workload",
@ -223,6 +227,16 @@ def client_errors(config: dict[str, Any], required: dict[str, Any]) -> list[str]
return errors
def retired_redirect_errors(config: dict[str, Any]) -> list[str]:
clients = config.get("clients") if isinstance(config.get("clients"), list) else []
target = next(
(client for client in clients if isinstance(client, dict) and client.get("clientId") == OPENBAO_CLIENT["clientId"]),
{},
)
retired = sorted(set(RETIRED_OPENBAO_REDIRECT_URIS) & set(target.get("redirectUris") or []))
return [f"{OPENBAO_CLIENT['clientId']}.redirectUris retired: {', '.join(retired)}"] if retired else []
def upsert_client(config: dict[str, Any], required: dict[str, Any]) -> dict[str, Any]:
clients = config.get("clients")
if not isinstance(clients, list):
@ -265,7 +279,7 @@ def render_patch(config: dict[str, Any]) -> None:
def verify(config: dict[str, Any]) -> None:
errors = client_errors(config, OPENBAO_CLIENT) + client_errors(config, RAPP_QONTO_CLIENT) + lldap_errors(config)
errors = client_errors(config, OPENBAO_CLIENT) + client_errors(config, RAPP_QONTO_CLIENT) + retired_redirect_errors(config) + lldap_errors(config)
if errors:
for error in errors:
print(f"[FAIL] {error}")