coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document scope alignment and warden-sign readiness

Browse source
This commit is contained in:
tegwick 2026-06-30 00:52:05 +02:00
parent d8aadaffe3
commit ae685f3a0a
10 changed files with 736 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

58
docs/warden-sign-auth-capability.md
View file

@ -16,6 +16,10 @@ only; the operator receives `role_id` and `secret_id` out-of-band.
| SSH mount | `ssh` |
| Policy | `warden-sign` |
| AppRole | `warden-sign` |
| OIDC auth mount | `netkingdom` |
| OIDC role | `warden-sign` |
| OIDC role path | `auth/netkingdom/role/warden-sign` |
| OIDC bound group | `net-kingdom-admins` |
| Token TTL | `15m` |
| Secret ID TTL | `30m` |
| Secret ID uses | `1` |
@ -42,6 +46,60 @@ BAO_ADDR=https://bao.coulomb.social \
The bootstrap token file must be mode `0600`, revocable, and tracked in
[hardening-backlog.md](hardening-backlog.md) H0 until revoked and shredded.
## OIDC operator login pointer
For an attended human operator who has `bao` on the workstation, the intended
narrow login is:
```bash
bao login -method=oidc -path=netkingdom role=warden-sign
```
That role lives at `auth/netkingdom/role/warden-sign`, is bound through the
`groups` claim to `net-kingdom-admins`, and attaches only the `warden-sign`
policy. It is not the `platform-admin` role and not the whynot-design KV-read
role.
If the role has not been applied yet, create/update it from an approved OpenBao
operator context with this non-secret payload:
```json
{
"role_type": "oidc",
"allowed_redirect_uris": [
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback"
],
"oidc_scopes": ["openid", "profile", "email", "groups"],
"user_claim": "sub",
"groups_claim": "groups",
"bound_claims": {
"groups": ["net-kingdom-admins"]
},
"policies": "warden-sign",
"ttl": "15m"
}
```
Equivalent CLI path:
```bash
bao write auth/netkingdom/role/warden-sign @warden-sign-oidc-role.json
```
After login, verify the token shape without printing the token value:
```bash
bao token capabilities ssh/sign/agt-role
bao token capabilities ssh/sign/adm-role
bao token capabilities ssh/sign/atm-role
bao token capabilities auth/token/create
```
The first three should include `update`; the last one should not grant token
creation/admin capability.
## Handoff
Mint a fresh single-use AppRole `secret_id` and write both handoff values to