2026-09-02 01:24:08 +02:00
|
|
|
# OpenBao JWT login contract (engine consumer)
|
|
|
|
|
|
|
|
|
|
Steady-state engine authentication is the reviewed KeyCape
|
|
|
|
|
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
|
|
|
|
|
mount and exact-bound role. This repository does not invent that mount.
|
|
|
|
|
|
|
|
|
|
Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
|
|
|
|
|
the need to hold a standing OpenBao token:
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
mount: jwt
|
|
|
|
|
role: secrets-engine
|
|
|
|
|
bound_issuer: https://<keycape-issuer>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
|
|
|
|
|
through a temporary JSON file, never argv. The resulting OpenBao token is
|
|
|
|
|
revoked at the end of the command (`token revoke -self`). Evidence records
|
|
|
|
|
the provider name and an accessor fingerprint only.
|
|
|
|
|
|
2026-10-11 14:11:59 +02:00
|
|
|
railiance-platform published the exact consumer file on 2026-10-10 at
|
|
|
|
|
`docs/contracts/secrets-engine-openbao-jwt-login.yaml` (mount `keycape-services`,
|
|
|
|
|
role `secrets-engine-openbao`, issuer `https://kc.coulomb.social`). When configured,
|
|
|
|
|
`--auth auto` selects service-jwt; without a contract it keeps named bootstrap/env
|
|
|
|
|
providers. Explicit service-jwt fails closed when configuration is missing.
|
|
|
|
|
The current service token is login-self-only and cannot perform protected lane
|
|
|
|
|
operations. T06 also requires a reviewed task-scoped execution entitlement and
|
|
|
|
|
functional steady-state adoption; see [final acceptance](service-jwt-final-acceptance.md).
|
2026-09-02 01:24:08 +02:00
|
|
|
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.
|
