tegwick
4c3a0f4d3a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6ef-4273-7fc2-8741-dc96b3e5fe0d
91 lines
4.6 KiB
Markdown
91 lines
4.6 KiB
Markdown
# OpenBao platform-admin login
|
||
|
||
## Worker checklist
|
||
|
||
Use this lane only for an attended OpenBao control-plane operation whose
|
||
reviewed procedure requires `platform-admin`, such as configuring a database
|
||
secrets-engine connection, policies, auth roles, or token roles. It is not a
|
||
workload KV-read lane and it does not provision a secret value.
|
||
|
||
1. Plan the exact administration need before drafting any operator step:
|
||
|
||
```bash
|
||
warden plan "attended OpenBao platform administration for <reviewed operation>" --json
|
||
```
|
||
|
||
The result must select `openbao-platform-admin-login`, return
|
||
`founder_required`, and name one `oidc_login` act. If it selects
|
||
`openbao-api-key`, a workload role, paste-once provisioning, or root, stop and
|
||
report a routing defect.
|
||
|
||
2. The operator performs the identity act and the separately reviewed owner
|
||
command through one contained envelope:
|
||
|
||
```bash
|
||
warden access openbao-platform-admin-login --exec -- <reviewed-owner-command>
|
||
```
|
||
|
||
Warden refuses a login-only `--fetch`. Before OIDC it proves the caller's
|
||
default home is usable, creates a caller-owned `0700` isolated home and a
|
||
`0600` token helper, and then runs `bao login -no-print` with both stdout and
|
||
stderr captured. The reviewed command runs in the same contained home with
|
||
both streams captured; it must persist any permitted metadata evidence itself
|
||
and remain silent. Warden self-revokes the session and removes the helper on
|
||
every success or failure path.
|
||
|
||
Safety does not rely on `-no-print`. Login output stays contained and is
|
||
accepted only after successful helper persistence. Any child output (including
|
||
whitespace), persistence defect, non-zero exit, or revocation/cleanup defect
|
||
fails closed.
|
||
Captured bytes are never returned, logged, excerpted, hashed, or fingerprinted.
|
||
Do not paste a token into chat, State Hub, a shell argument, or a handoff file.
|
||
Root is offline break-glass authority, not a fallback for failure.
|
||
|
||
3. Verify authority using metadata or capabilities only, never by reading a
|
||
secret value. Then run only the separately reviewed owner procedure. For the
|
||
database engine this procedure lives in `rapp-postgres`; the login does not
|
||
itself approve configuration changes.
|
||
|
||
4. Confirm the contained command exits successfully. Warden performs and checks
|
||
`bao token revoke -self` inside the contained environment before cleanup; do
|
||
not retain or reuse the helper.
|
||
|
||
If browser login fails before authentication, confirm the `netkingdom` auth
|
||
mount, `platform-admin` role, and allowed callback with `railiance-platform` and
|
||
`key-cape`. Do not retry with a workload-specific OIDC role: it is intentionally
|
||
incapable of OpenBao control-plane administration.
|
||
|
||
## Exit status and audit
|
||
|
||
After argument/configuration validation, the contained envelope returns:
|
||
|
||
| Exit | Audit outcome | Meaning |
|
||
| --- | --- | --- |
|
||
| 0 | `ok` | Login, silent child, self-revocation and cleanup succeeded. |
|
||
| 10 | `login_failed` | Login or private-home preflight failed; child did not run. |
|
||
| 11 | `child_failed` | Child could not start or exited non-zero. |
|
||
| 12 | `child_output` | Child emitted stdout/stderr, even whitespace; takes precedence over child exit failure. |
|
||
| 13 | `revoke_unconfirmed` | Child succeeded silently, but self-revocation was not confirmed. |
|
||
| 14 | `cleanup_failed` | Private storage cleanup failed; overrides the prior phase. |
|
||
|
||
Both `access-audit.log` and `audit.jsonl` record the Warden exit code and phase
|
||
outcome, never captured bytes. Revocation warnings accompany child failures too.
|
||
Codes 11–14 do not establish that the child made no changes: check its permitted
|
||
metadata receipt before retrying. A zero exit from `bao token revoke -self` is
|
||
Warden's revocation confirmation; no post-revoke lookup is used. An arbitrary
|
||
lookup failure would not prove revocation.
|
||
|
||
On the WSL workstation, use the ops-bridge `openbao-ui-railiance01` tunnel at
|
||
`http://127.0.0.1:18200` for `BAO_ADDR` and `VAULT_ADDR`, with the founder's TTY
|
||
and a working browser opener (`xdg-open`, or the configured OpenBao browser).
|
||
`bao.coulomb.social` serves a public notice, not OpenBao. The captured OIDC output
|
||
is not a browser fallback. Check the opener before starting an attended login.
|
||
The reviewed child must redirect both streams if its tools normally print success
|
||
messages; it should write only approved, value-free evidence to its own receipt.
|
||
|
||
## Authority
|
||
|
||
- OpenBao policy and role owner: `railiance-platform/docs/openbao.md`
|
||
- Human identity and MFA provider: key-cape / Keycloak
|
||
- Database-engine procedure owner: `rapp-postgres`
|
||
- Routing decision and founder-act surface: WARDEN-WP-0029
|