net-kingdom/workplans/NK-WP-0032-openbao-operator-loopback-callback.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	origin	origin_ref
NK-WP-0032	workplan	Admit the operator-tunneled OpenBao browser callback	infotech	net-kingdom	blocked	codex	net-kingdom	2026-08-23	2026-08-23	RMASTER-WP-0020-T09 RAILIANCE-WP-0027-T03	routed	State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca

NK-WP-0032 — OpenBao operator loopback callback

Goal

Admit the exact callback derived by the ClusterIP-only OpenBao UI gateway when operators reach it through the named openbao-ui-railiance01 tunnel, without weakening MFA or broadening the OpenBao policy.

T01 — Update and validate the code-defined callback contract

id: NK-WP-0032-T01
status: done
priority: high

Add http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback to the KeyCape openbao-admin public-PKCE client, the OpenBao platform-admin role template, bootstrap validation, live authorization verifier, and operator documentation. Preserve the former public callbacks only for the bounded listener rollback window.

Completed 2026-08-23. Three focused regression tests, Python compilation, Bash syntax validation, and git diff --check pass.

T02 — Apply and prove the live KeyCape client addition

id: NK-WP-0032-T02
status: done
priority: high

Patch only the code-defined non-secret client configuration, restart KeyCape, and prove both the live Secret contract and public authorize endpoint accept the exact loopback URI. Do not record the Secret contents or an authorization code.

Completed 2026-08-23 on Railiance01. sso/keycape-config was patched without printing decoded data, deployment/keycape rolled out successfully, and the value-safe verifier proved the live client contract, exact loopback redirect, legacy rollback redirects, and OIDC discovery endpoint. No authorization code or Secret value was observed.

T03 — Apply and prove the live OpenBao role addition

id: NK-WP-0032-T03
status: wait
priority: high

An attended platform-admin/root-sudo authority must apply the updated role template to auth/netkingdom/role/platform-admin. Record only that the exact URI is admitted. Do not record a token, accessor, authorization code, callback query, browser storage, or role response body.

T04 — Return attended-login evidence to Railiance Platform

id: NK-WP-0032-T04
status: wait
priority: high

After T02 and T03 pass, perform one attended MFA login through http://127.0.0.1:18200 and return only the success/failure outcome. This task does not authorize public Ingress retraction; Railiance Platform retains that separate guarded hold point.