coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Request groups scope for whynot OIDC role

Browse source
This commit is contained in:
tegwick 2026-06-28 13:23:14 +02:00
parent adf865611c
commit 3527bc1cae
7 changed files with 74 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
workplans/RAILIANCE-WP-0006-workload-kv-access-lanes.md
View file

@ -191,6 +191,11 @@ subject; do not create an unbounded OIDC role.
`workload-kv-read-whynot-design-npm-publish` policy, `ttl=15m`, and the approved
browser/local CLI callback URIs.
**2026-06-28:** Positive verification found the OIDC role was missing
`oidc_scopes`, causing OpenBao login to fail with `groups claim not found`.
Updated the live role and source CCR to request `openid`, `profile`, `email`,
and `groups`, matching the platform-admin OIDC scope shape.
## T04 - Provision the KV path without exposing the token
```task