coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prune retired bao.coulomb.social callbacks from platform-admin; declare OIDC mount config
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Attended run 2026-09-23T23:11Z: status pruned, tunnel callback kept, all
other role settings preserved and verified on readback. Declarations now
match live; railiance-platform owns the mount config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 01:14:43 +02:00
parent df4cbae2e9
commit bcf6f9bf12
5 changed files with 72 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

41
docs/evidence/2026-09-24-platform-admin-callback-prune.json Normal file
View file

@ -0,0 +1,41 @@
{
"allowed_redirect_uris": [
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
],
"changed": true,
"credential_values_emitted": false,
"mount_configs": {
"keycape": {
"bound_issuer": "",
"default_role": "platform-admin",
"jwt_supported_algs": [],
"namespace_in_state": true,
"oidc_client_id": "openbao-admin",
"oidc_discovery_url": "https://kc.coulomb.social",
"oidc_response_mode": "",
"oidc_response_types": [],
"provider_config": {}
},
"netkingdom": {
"bound_issuer": "",
"default_role": "platform-admin",
"jwt_supported_algs": [],
"namespace_in_state": true,
"oidc_client_id": "openbao-admin",
"oidc_discovery_url": "https://kc.coulomb.social",
"oidc_response_mode": "",
"oidc_response_types": [],
"provider_config": {}
}
},
"observed_at": "2026-09-23T23:11:14.580944+00:00",
"retired": [
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
],
"role": "auth/netkingdom/role/platform-admin",
"schema": "railiance-platform.openbao-callback-prune.v1",
"status": "pruned"
}

9
docs/openbao.md
View file

@ -400,8 +400,13 @@ Declared state of the administrator login (verified live 2026-09-23,
- role `auth/netkingdom/role/platform-admin`:
`openbao/auth/netkingdom-platform-admin-role.json`. It is written by
net-kingdom `sso-mfa/k8s/keycape/configure-openbao-oidc.sh`, which lacks
`operator-custody` and still lists retired `bao.coulomb.social` callbacks.
railiance-platform only. Since net-kingdom `a356f64`, its
`configure-openbao-oidc.sh` no longer writes the role. The retired
`bao.coulomb.social` callbacks were pruned on 2026-09-23
(`docs/evidence/2026-09-24-platform-admin-callback-prune.json`).
- OIDC mount config: `openbao/auth/netkingdom-oidc-config.json` and
`openbao/auth/keycape-oidc-config.json`, owned by railiance-platform. The
compatibility `oidc_client_secret` is not declared.
- policies `openbao/policies/platform-admin.hcl` and
`openbao/policies/operator-custody.hcl`, plus the built-in `default`
(`token_no_default_policy: false`). `default` grants `auth/token/revoke-self`

12
openbao/auth/keycape-oidc-config.json Normal file
View file

@ -0,0 +1,12 @@
{
"_note": "Declared from attended read 2026-09-23 (docs/evidence/2026-09-24-platform-admin-callback-prune.json). oidc_client_secret is a KeyCape public-PKCE compatibility value, never returned by OpenBao and deliberately not declared here.",
"bound_issuer": "",
"default_role": "platform-admin",
"jwt_supported_algs": [],
"namespace_in_state": true,
"oidc_client_id": "openbao-admin",
"oidc_discovery_url": "https://kc.coulomb.social",
"oidc_response_mode": "",
"oidc_response_types": [],
"provider_config": {}
}

12
openbao/auth/netkingdom-oidc-config.json Normal file
View file

@ -0,0 +1,12 @@
{
"_note": "Declared from attended read 2026-09-23 (docs/evidence/2026-09-24-platform-admin-callback-prune.json). oidc_client_secret is a KeyCape public-PKCE compatibility value, never returned by OpenBao and deliberately not declared here.",
"bound_issuer": "",
"default_role": "platform-admin",
"jwt_supported_algs": [],
"namespace_in_state": true,
"oidc_client_id": "openbao-admin",
"oidc_discovery_url": "https://kc.coulomb.social",
"oidc_response_mode": "",
"oidc_response_types": [],
"provider_config": {}
}

2
openbao/auth/netkingdom-platform-admin-role.json
View file

@ -2,8 +2,6 @@
"allowed_redirect_uris": [
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
],
"bound_audiences": [],