tegwick
61aeafef71
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
87 lines
2.6 KiB
Markdown
87 lines
2.6 KiB
Markdown
---
|
|
id: NK-WP-0032
|
|
type: workplan
|
|
title: "Admit the operator-tunneled OpenBao browser callback"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: net-kingdom
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RMASTER-WP-0020-T09
|
|
- RAILIANCE-WP-0027-T03
|
|
origin: routed
|
|
origin_ref: "State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca"
|
|
---
|
|
|
|
# NK-WP-0032 — OpenBao operator loopback callback
|
|
|
|
## Goal
|
|
|
|
Admit the exact callback derived by the ClusterIP-only OpenBao UI gateway when
|
|
operators reach it through the named `openbao-ui-railiance01` tunnel, without
|
|
weakening MFA or broadening the OpenBao policy.
|
|
|
|
## T01 — Update and validate the code-defined callback contract
|
|
|
|
```task
|
|
id: NK-WP-0032-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Add `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
|
|
KeyCape `openbao-admin` public-PKCE client, the OpenBao `platform-admin` role
|
|
template, bootstrap validation, live authorization verifier, and operator
|
|
documentation. Preserve the former public callbacks only for the bounded
|
|
listener rollback window.
|
|
|
|
Completed 2026-08-23. Three focused regression tests, Python compilation, Bash
|
|
syntax validation, and `git diff --check` pass.
|
|
|
|
## T02 — Apply and prove the live KeyCape client addition
|
|
|
|
```task
|
|
id: NK-WP-0032-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Patch only the code-defined non-secret client configuration, restart KeyCape,
|
|
and prove both the live Secret contract and public authorize endpoint accept
|
|
the exact loopback URI. Do not record the Secret contents or an authorization
|
|
code.
|
|
|
|
Completed 2026-08-23 on Railiance01. `sso/keycape-config` was patched without
|
|
printing decoded data, `deployment/keycape` rolled out successfully, and the
|
|
value-safe verifier proved the live client contract, exact loopback redirect,
|
|
legacy rollback redirects, and OIDC discovery endpoint. No authorization code
|
|
or Secret value was observed.
|
|
|
|
## T03 — Apply and prove the live OpenBao role addition
|
|
|
|
```task
|
|
id: NK-WP-0032-T03
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
An attended platform-admin/root-sudo authority must apply the updated role
|
|
template to `auth/netkingdom/role/platform-admin`. Record only that the exact
|
|
URI is admitted. Do not record a token, accessor, authorization code, callback
|
|
query, browser storage, or role response body.
|
|
|
|
## T04 — Return attended-login evidence to Railiance Platform
|
|
|
|
```task
|
|
id: NK-WP-0032-T04
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
After T02 and T03 pass, perform one attended MFA login through
|
|
`http://127.0.0.1:18200` and return only the success/failure outcome. This task
|
|
does not authorize public Ingress retraction; Railiance Platform retains that
|
|
separate guarded hold point.
|