coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stop configure-openbao-oidc.sh from writing the platform-admin role
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The role's policies, callbacks and bound claims are declared centrally by
railiance-platform (openbao/auth/netkingdom-platform-admin-role.json).
Rerunning the script would have dropped the live operator-custody policy
and re-added the retired bao.coulomb.social callbacks. The script now only
configures the OIDC mounts and fails if the declared role is missing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:39:53 +02:00
parent 116643fafe
commit a356f640ac
2 changed files with 17 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

9
sso-mfa/k8s/keycape/README.md
View file

@ -169,9 +169,12 @@ KeyCape:
bash ./configure-openbao-oidc.sh bash ./configure-openbao-oidc.sh
``` ```
That script registers the browser UI callbacks on the OpenBao That script enables and configures the OpenBao `netkingdom` and compatibility
`auth/netkingdom/role/platform-admin` role and the compatibility `keycape` OIDC mounts. It never writes the `platform-admin` role: the role's
`auth/keycape/role/platform-admin` role. Browser operators should use the policies, callbacks and bound claims are declared centrally by
railiance-platform at `openbao/auth/netkingdom-platform-admin-role.json`, and
the script fails if the declared role is missing. Any additional allowance
belongs in that declaration, not here. Browser operators should use the
OpenBao UI at `http://127.0.0.1:18200` through the named OpenBao UI at `http://127.0.0.1:18200` through the named
`openbao-ui-railiance01` tunnel, leave namespace blank, choose OIDC, set mount `openbao-ui-railiance01` tunnel, leave namespace blank, choose OIDC, set mount
path `netkingdom`, and use role `platform-admin`; root-token browser use is path `netkingdom`, and use role `platform-admin`; root-token browser use is

42
sso-mfa/k8s/keycape/configure-openbao-oidc.sh
View file

@ -29,34 +29,11 @@ OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
# KeyCape supports confidential downstream clients. # KeyCape supports confidential downstream clients.
OPENBAO_OIDC_MOUNTS="netkingdom keycape" OPENBAO_OIDC_MOUNTS="netkingdom keycape"
# Keep array-valued groups in groups_claim/bound_claims only. OpenBao # The platform-admin role (policies, callbacks, bound claims) is owned and
# claim_mappings copy scalar claim values into metadata and will fail if the # declared by railiance-platform at
# groups array is mapped there. # openbao/auth/netkingdom-platform-admin-role.json. This script never writes
cat >/tmp/openbao-platform-admin-role.json <<'"'"'ROLE_JSON'"'"' # the role: it configures the OIDC mount and requires the declared role to
{ # exist. Additional allowances belong in that central declaration.
"role_type": "oidc",
"user_claim": "sub",
"groups_claim": "groups",
"oidc_scopes": ["openid", "profile", "email", "groups"],
"allowed_redirect_uris": [
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
],
"bound_claims": {
"groups": ["net-kingdom-admins"]
},
"claim_mappings": {
"email": "email",
"preferred_username": "username"
},
"policies": ["platform-admin"],
"ttl": "1h"
}
ROLE_JSON
for mount in $OPENBAO_OIDC_MOUNTS; do for mount in $OPENBAO_OIDC_MOUNTS; do
bao auth enable -path="$mount" oidc >/tmp/openbao-${mount}-auth-enable.out 2>/tmp/openbao-${mount}-auth-enable.err || { bao auth enable -path="$mount" oidc >/tmp/openbao-${mount}-auth-enable.out 2>/tmp/openbao-${mount}-auth-enable.err || {
if grep -q "path is already in use" /tmp/openbao-${mount}-auth-enable.err; then if grep -q "path is already in use" /tmp/openbao-${mount}-auth-enable.err; then
@ -73,11 +50,14 @@ ROLE_JSON
oidc_client_secret="keycape-public-pkce-compatibility-value" \ oidc_client_secret="keycape-public-pkce-compatibility-value" \
default_role="platform-admin" default_role="platform-admin"
bao write "auth/${mount}/role/platform-admin" @/tmp/openbao-platform-admin-role.json if ! bao read "auth/${mount}/role/platform-admin" >/dev/null 2>&1; then
printf "auth/%s/role/platform-admin is missing; apply the railiance-platform declaration (openbao/auth/netkingdom-platform-admin-role.json)\n" "$mount" >&2
exit 1
fi
bao write "sys/auth/${mount}/tune" listing_visibility=unauth bao write "sys/auth/${mount}/tune" listing_visibility=unauth
printf "configured auth/%s/role/platform-admin and listing_visibility=unauth\n" "$mount" >&2 printf "configured auth/%s (role preserved) and listing_visibility=unauth\n" "$mount" >&2
done done
rm -f /tmp/openbao-platform-admin-role.json /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err rm -f /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err
unset BAO_TOKEN unset BAO_TOKEN
' '