coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire bao.coulomb.social callbacks from the KeyCape openbao-admin client
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
The name was retired on 2026-09-15. Remove both public UI callbacks from
the code-defined client (openbao-client-config.py, create-secrets.sh), stop
probing them in verify-openbao-client.sh, and fail verification in
openbao-client-config.py and verify-t07.sh if either is registered again.
The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:41:35 +02:00
parent a356f640ac
commit 3b14469afb
6 changed files with 51 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

9
sso-mfa/k8s/verify-t07.sh
View file

@ -188,8 +188,6 @@ required_redirects = {
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
}
required_scopes = {"openid", "profile", "email", "groups"}
missing_redirects = sorted(required_redirects - set(target.get("redirectUris") or []))
@ -200,6 +198,13 @@ if target.get("clientType") != "public":
if missing_redirects:
print("openbao-admin missing redirect URI(s): " + ", ".join(missing_redirects))
raise SystemExit(4)
retired_redirects = sorted({
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
} & set(target.get("redirectUris") or []))
if retired_redirects:
print("openbao-admin still registers retired redirect URI(s): " + ", ".join(retired_redirects))
raise SystemExit(6)
if missing_scopes:
print("openbao-admin missing scope(s): " + ", ".join(missing_scopes))
raise SystemExit(5)