tegwick
9ec4e0bea5
The anonymous JWT login inherited BAO_TOKEN/VAULT_TOKEN and the bao CLI token helper, so it presented an env/operator token alongside the JWT. Run that login with no env token and a token helper that returns none, proven against the real bao CLI. This closes secrets-engine's part of the CCR-2026-0038 no-fallback check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 544698@bnt-lap001 Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db
22 lines
1.8 KiB
JSON
22 lines
1.8 KiB
JSON
{
|
|
"status": "passed",
|
|
"check": "CCR-2026-0038 negative: a failed login never falls back to bootstrap/env providers",
|
|
"design_ref": "railiance-platform docs/credential-lane-designs/secrets-engine-service-jwt.md (separately prove a failed login never consults bootstrap/env providers)",
|
|
"observed_at": "2026-10-10",
|
|
"scope": "secrets-engine consumer side; OpenBao claim refusals stay with railiance-platform and key-cape (KEY-WP-0039)",
|
|
"finding_fixed": "Before this change the anonymous JWT login inherited BAO_TOKEN/VAULT_TOKEN from the parent environment, and the CLI token helper, and sent that token as X-Vault-Token alongside the JWT. The founder probe on 2026-10-10 was clean only because its command unset those variables.",
|
|
"proofs": [
|
|
{"kind": "unit", "test": "tests/test_engine_auth.py::test_service_jwt_refuses_bootstrap_file_and_does_not_read_env", "result": "passed", "shows": "selection refuses a bootstrap file with service-jwt"},
|
|
{"kind": "unit", "test": "tests/test_engine_auth.py::test_jwt_login_failure_does_not_fall_back_to_env", "result": "passed", "shows": "an exchange failure raises without resolving an env/bootstrap client"},
|
|
{"kind": "unit", "test": "tests/test_engine_auth.py::test_login_jwt_presents_no_ambient_env_or_helper_token", "result": "passed", "shows": "the login subprocess has no BAO_TOKEN/VAULT_TOKEN and a token helper that yields none"},
|
|
{"kind": "real-cli", "binary": "OpenBao v2.5.5 bao CLI", "target": "local loopback listener recording X-Vault-Token", "result": "passed",
|
|
"observations": {
|
|
"env_token_previous_path_sent": true,
|
|
"env_token_login_jwt_sent": false,
|
|
"helper_token_previous_path_sent": true,
|
|
"helper_token_login_jwt_sent": false
|
|
},
|
|
"note": "Sentinel strings only; no real token, JWT or OpenBao server was used."}
|
|
],
|
|
"full_suite": "passed"
|
|
}
|