c924ff2279
- CCR-2026-0040/0043 re-applied 2026-10-10T09:15Z. Probe: generated v1, a second run refused (already_present), tokens revoked, no value read, probe entry deleted. Receipts in docs/evidence. - CCR-2026-0038: login proof passed (secrets-engine a963a77); the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. RPF-WP-0035-T02 still waits on the negative claim checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
106 lines
4.7 KiB
YAML
106 lines
4.7 KiB
YAML
id: CCR-2026-0043
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: broker-issuer-binding
|
|
title: Operator OIDC role for the keycape-client-secret-generate broker issuer (net-kingdom-admins,
|
|
aal2)
|
|
status: applied
|
|
created: '2026-10-10'
|
|
updated: '2026-10-10'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: RPF-WP-0054-T05. ops-warden (23985370) names the caller as the human operator
|
|
who runs warden case run, using their own OIDC session. Founder chose net-kingdom-admins
|
|
+ aal2 on 2026-10-10. The issuer policy is live from CCR-2026-0040.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- key-cape-owner
|
|
comments:
|
|
- at: '2026-10-10T08:27:32+00:00'
|
|
reviewer: platform-owner, key-cape-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: 'Approve issuer binding for keycape-client-secret-generate: net-kingdom-admins
|
|
+ aal2 (RPF-WP-0054).'
|
|
- at: '2026-10-10T08:27:32+00:00'
|
|
reviewer: founder
|
|
decision: binding_confirmed
|
|
comment: groups=[net-kingdom-admins] and /assurance/level=aal2, same binding as
|
|
CCR-2026-0034.
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: credential-broker
|
|
environment: production
|
|
purpose: Let a net-kingdom-admins member with a verified second factor log in for
|
|
15 minutes with only the broker issuer policy, so credential.py generate can mint
|
|
the create-only keycape/client-secret-generate token.
|
|
openbao:
|
|
issuer_policy: credential-broker-keycape-client-secret-generate-issuer
|
|
auth:
|
|
method: oidc
|
|
mount: netkingdom
|
|
role: credential-broker-keycape-client-secret-generate
|
|
role_file: openbao/auth/credential-broker-keycape-client-secret-generate-oidc-role.json
|
|
bound_claims_confirmed: true
|
|
founder_confirmation_items:
|
|
- bound_claims_confirmed stays false until the founder confirms groups=[net-kingdom-admins]
|
|
and /assurance/level=aal2, the same binding as CCR-2026-0034 (key-cape b2ed890f).
|
|
- The role carries only the issuer policy. It cannot read or write KV; it can mint
|
|
keycape-client-secret-generate tokens through that token role, and look up and revoke
|
|
tokens by accessor.
|
|
- Loopback CLI callbacks only (no UI callback); 15m with unlimited uses inside that
|
|
lifetime (a limited-use token cannot create the child grant token), no default policy.
|
|
access_frontdoor:
|
|
type: none
|
|
catalog_id: none
|
|
risk:
|
|
level: medium
|
|
notes:
|
|
- Membership of net-kingdom-admins is the access decision; that group already holds
|
|
the KeyCape operator reader (CCR-2026-0034).
|
|
- Worst case within 15m is unused keycape/<client_id> entries; existing entries
|
|
cannot be overwritten (CCR-2026-0040 is create-only).
|
|
verification:
|
|
positive:
|
|
- Readback after apply matches source for the role (done by applier-apply; prints
|
|
nothing).
|
|
- A member with aal2 logs in with role credential-broker-keycape-client-secret-generate
|
|
and the token's policies are exactly [credential-broker-keycape-client-secret-generate-issuer].
|
|
negative:
|
|
- A non-member or a member without aal2 cannot obtain the role.
|
|
- The issuer token is denied on platform/* and on token creation through any other
|
|
role.
|
|
activation_conditions:
|
|
- Founder approval (two reviews) and bound_claims_confirmed true.
|
|
- CCR-2026-0040 applied (done 2026-10-09).
|
|
evidence:
|
|
- at: '2026-10-10T08:27:38+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
|
- 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
|
|
- Readback matched source for the role.
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
- at: '2026-10-10T09:15:56+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
|
|
- 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
|
|
- Readback matched source for the role.
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
lifecycle:
|
|
deactivate: Delete auth/netkingdom/role/credential-broker-keycape-client-secret-generate.
|
|
rotate: Not applicable (no stored credential).
|
|
compromised: Delete the role, revoke issued tokens; review keycape/ metadata for
|
|
entries without an accepted case.
|
|
state_hub:
|
|
workplan: RPF-WP-0054
|
|
task: RPF-WP-0054-T05
|