24 lines
967 B
Markdown
24 lines
967 B
Markdown
|
# OpenBao JWT login contract (engine consumer)
|
||
|
|
|
||
|
|
Steady-state engine authentication is the reviewed KeyCape
|
||
|
|
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
|
||
|
|
mount and exact-bound role. This repository does not invent that mount.
|
||
|
|
|
||
|
|
Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
|
||
|
|
the need to hold a standing OpenBao token:
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
mount: jwt
|
||
|
|
role: secrets-engine
|
||
|
|
bound_issuer: https://<keycape-issuer>
|
||
|
|
```
|
||
|
|
|
||
|
|
`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
|
||
|
|
through a temporary JSON file, never argv. The resulting OpenBao token is
|
||
|
|
revoked at the end of the command (`token revoke -self`). Evidence records
|
||
|
|
the provider name and an accessor fingerprint only.
|
||
|
|
|
||
|
|
Until railiance-platform publishes that file, `--auth auto` keeps the named
|
||
|
|
bootstrap-file and `BAO_TOKEN` providers. `--auth service-jwt` fail-closes.
|
||
|
|
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.
|