3fbb610d1f
Answers the-custodian 641673a4. An attended read-only check (receipt docs/evidence/2026-09-23-openbao-platform-admin-check.json) found: - live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27); repo now matches live (sha256 0ca5b821...). No live write. - role also attaches operator-custody (undeclared); declared here. - role declared as openbao/auth/netkingdom-platform-admin-role.json. - default policy is attached and grants revoke-self/lookup-self, so the suspected missing grant is not the cause of warden's unconfirmed revocation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
97 lines
2.5 KiB
JSON
97 lines
2.5 KiB
JSON
{
|
|
"applied": false,
|
|
"attached_policy_sha256": {
|
|
"default": "cf5e073df536011f977880d58be6a32acb04cfcd195364241f2d99f6601c2e3f",
|
|
"operator-custody": "84eeabeeb11c15e2f8940ed23d6ecc434a3299405fd70ea9c05d959f925970f7",
|
|
"platform-admin": "0ca5b821666bdf262bb0742a0031a4f0f9f3d315ef85e951d6b9ce20e7563394"
|
|
},
|
|
"changed": false,
|
|
"credential_values_emitted": false,
|
|
"observed_at": "2026-09-23T17:25:18.820429+00:00",
|
|
"policy": {
|
|
"declared_sha256": "43a53b00fab59fc62ad586d81f89f36293669c2f8ccedbfb1e3d70618d9af767",
|
|
"live_sha256": "0ca5b821666bdf262bb0742a0031a4f0f9f3d315ef85e951d6b9ce20e7563394",
|
|
"matches_declared": false
|
|
},
|
|
"policy_name": "platform-admin",
|
|
"role": {
|
|
"allowed_redirect_uris": [
|
|
"http://localhost:8250/oidc/callback",
|
|
"http://127.0.0.1:8250/oidc/callback",
|
|
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
|
|
"https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
|
|
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
],
|
|
"bound_audiences": [],
|
|
"bound_claims": {
|
|
"groups": [
|
|
"net-kingdom-admins"
|
|
]
|
|
},
|
|
"bound_claims_type": "string",
|
|
"bound_subject": "",
|
|
"claim_mappings": {
|
|
"email": "email",
|
|
"preferred_username": "username"
|
|
},
|
|
"groups_claim": "groups",
|
|
"oidc_scopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"policies": [
|
|
"platform-admin",
|
|
"operator-custody"
|
|
],
|
|
"role_type": "oidc",
|
|
"token_bound_cidrs": [],
|
|
"token_explicit_max_ttl": 0,
|
|
"token_max_ttl": 0,
|
|
"token_no_default_policy": false,
|
|
"token_num_uses": 0,
|
|
"token_period": 0,
|
|
"token_policies": [
|
|
"platform-admin",
|
|
"operator-custody"
|
|
],
|
|
"token_ttl": 3600,
|
|
"token_type": "default",
|
|
"ttl": 3600,
|
|
"user_claim": "sub"
|
|
},
|
|
"role_path": "auth/netkingdom/role/platform-admin",
|
|
"schema": "railiance-platform.openbao-platform-admin-check.v1",
|
|
"self_capabilities": {
|
|
"auth/token/lookup-self": [
|
|
"read"
|
|
],
|
|
"auth/token/revoke-self": [
|
|
"update"
|
|
]
|
|
},
|
|
"status": "partial",
|
|
"steps": {
|
|
"capabilities_self": {
|
|
"ok": true
|
|
},
|
|
"read_attached_rules": {
|
|
"ok": true
|
|
},
|
|
"read_policy": {
|
|
"ok": true
|
|
},
|
|
"read_role": {
|
|
"ok": true
|
|
},
|
|
"token_lookup_self": {
|
|
"detail": [
|
|
"Usage: bao token <subcommand> [options] [args]"
|
|
],
|
|
"error": "exit_1",
|
|
"ok": false
|
|
}
|
|
},
|
|
"token": null
|
|
}
|