coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/credential-lane-designs/attended-service-credential-delivery.md
codex 8cab281ffc
All checks were successful
CCR intake gate / gate (push) Successful in 9s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
CCR-2026-0055: state the gate precisely (attended pi-admin, MFA login proves the write) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
2026-10-31 11:07:05 +01:00

1.5 KiB
Raw Blame History

Attended service credential delivery

Request type attended-service-credential-delivery (scripts/attended_service_delivery.py), first used by CCR-2026-0055 (NetKingdom svc-privacyidea, NK-WP-0056-T04).

Some services keep a credential in their own encrypted store and accept it only through an administrator API that a person operates. privacyIDEA's LDAP resolver is one: its BINDPW lives encrypted in the privacyIDEA database and only the pi-admin API may change it. ESO cannot deliver such a value, and an unattended job would need the administrator password standing in the cluster.

The contract therefore holds the value in OpenBao and nothing else:

  • openbao.auth is the attended platform-admin OIDC session on netkingdom; runtime_access: false; initial_cas: 0. No policy, auth role, ESO object or other access may be declared.
  • The runtime frontdoor stays disabled (access_frontdoor.resolvable: false).
  • delivery names the service, the target inside it, the owner's procedure and the gate (the attended person and the proof they run).
  • Approval follows review.required_approvers; from applied onward every listed role must have approved.

The owner's procedure reads the value in memory under the attended session and writes it into the service; the person runs it and proves the write with an MFA login through the service. A rotation needs no decrypted custody copy. Modelled on attended-host-key-delivery (CCR-2026-0028), which delivers to a host file instead of a service.