coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: exchange scoped approval service tokens per request
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 07:06:05 +02:00
parent 3a19069b4b
commit 7688445184
14 changed files with 859 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/service-auth.md
View file

@ -31,3 +31,11 @@ those named providers and `--auth service-jwt` fail-closes. See
Canonical provider contract:
`key-cape/docs/openbao-service-auth-contract.md` (reviewed 2026-08-23).
## Approval identity is separate
[Approval service authentication](approval-service-auth.md) uses its own
client-secret input, resource audience, exact tenant:platform and per-request
read/consume scopes. Never put that credential into the OpenBao provider.
Both providers now validate KeyCape’s actual `level`/`methods` assurance shape;
the old `aal`/`method` fixture was incompatible with the issuer.