coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/openbao-jwt-login.md
tegwick 3abee434df
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Add named engine auth and accessor-file session revoke 
Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
2026-09-02 01:24:08 +02:00

967 B
Raw Permalink Blame History

OpenBao JWT login contract (engine consumer)

Steady-state engine authentication is the reviewed KeyCape secrets-engine-openbao identity plus a platform-owned OpenBao JWT auth mount and exact-bound role. This repository does not invent that mount.

Point SECRETS_ENGINE_OPENBAO_JWT_LOGIN at a mode-normal YAML file outside the need to hold a standing OpenBao token:

mount: jwt
role: secrets-engine
bound_issuer: https://<keycape-issuer>

bound_issuer must equal SECRETS_ENGINE_KEYCAPE_ISSUER. The JWT is sent through a temporary JSON file, never argv. The resulting OpenBao token is revoked at the end of the command (token revoke -self). Evidence records the provider name and an accessor fingerprint only.

Until railiance-platform publishes that file, --auth auto keeps the named bootstrap-file and BAO_TOKEN providers. --auth service-jwt fail-closes. A service-jwt selection never reads --bootstrap-token-file or BAO_TOKEN.