coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add named engine auth and accessor-file session revoke
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 01:24:08 +02:00
parent a94003de4f
commit 3abee434df
18 changed files with 698 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/openbao-jwt-login.md Normal file
View file

@ -0,0 +1,23 @@
# OpenBao JWT login contract (engine consumer)
Steady-state engine authentication is the reviewed KeyCape
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
mount and exact-bound role. This repository does not invent that mount.
Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
the need to hold a standing OpenBao token:
```yaml
mount: jwt
role: secrets-engine
bound_issuer: https://<keycape-issuer>
```
`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
through a temporary JSON file, never argv. The resulting OpenBao token is
revoked at the end of the command (`token revoke -self`). Evidence records
the provider name and an accessor fingerprint only.
Until railiance-platform publishes that file, `--auth auto` keeps the named
bootstrap-file and `BAO_TOKEN` providers. `--auth service-jwt` fail-closes.
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.