bedab6f5ab
The warden openbao-platform-admin-login lane runs one silent child per login, fails closed on any output and self-revokes; the old runbook printed output and rolled back from a standing session that cannot exist. - scripts/openbao-platform-admin-aal2.sh (+ .py): prepare (backup + assurance claim mapping), apply (gated on this login's assurance_level=aal2, readback of bound_claims), verify, rollback from the backup receipt via a fresh lane login, rollback-body for the docs/openbao.md break-glass path. 0600 O_EXCL receipts, value-free; no stdout/stderr. - Role declaration maps /assurance/level to token metadata assurance_level. - tests/test_openbao_platform_admin_aal2.py: fake bao end-to-end. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
47 lines
1,021 B
JSON
47 lines
1,021 B
JSON
{
|
|
"allowed_redirect_uris": [
|
|
"http://localhost:8250/oidc/callback",
|
|
"http://127.0.0.1:8250/oidc/callback",
|
|
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
],
|
|
"bound_audiences": [],
|
|
"bound_claims": {
|
|
"groups": [
|
|
"net-kingdom-admins"
|
|
],
|
|
"/assurance/level": "aal2"
|
|
},
|
|
"bound_claims_type": "string",
|
|
"bound_subject": "",
|
|
"claim_mappings": {
|
|
"/assurance/level": "assurance_level",
|
|
"email": "email",
|
|
"preferred_username": "username"
|
|
},
|
|
"groups_claim": "groups",
|
|
"oidc_scopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"policies": [
|
|
"platform-admin",
|
|
"operator-custody"
|
|
],
|
|
"role_type": "oidc",
|
|
"token_bound_cidrs": [],
|
|
"token_explicit_max_ttl": 0,
|
|
"token_max_ttl": 0,
|
|
"token_no_default_policy": false,
|
|
"token_num_uses": 0,
|
|
"token_period": 0,
|
|
"token_policies": [
|
|
"platform-admin",
|
|
"operator-custody"
|
|
],
|
|
"token_ttl": 3600,
|
|
"token_type": "default",
|
|
"ttl": 3600,
|
|
"user_claim": "sub"
|
|
}
|