Authenticate and validate private lifecycle commands #22

New issue

Closed

opened 2026-08-29 19:53:25 +00:00 by larandar · 0 comments

larandar commented

2026-08-29 19:53:25 +00:00

Owner

Proposal

Authenticate OpenBao as the sole lifecycle caller and validate the complete signed command before any Kanidm mutation.

Delivery class

agent-unit — implement src/private_api.rs with request fixtures derived from the Session OpenSpec.

Design

The transport peer must be OpenBao's dedicated service identity. Validate signature, request window, fresh operation ID, action, grant ID/version/digest, principal UUID/name, state, auth and credential generations, requested expiry, and predecessor ownership in order. Caller-supplied grant content is never authority.

Tasks

Add the typed command and result envelopes.
Add peer and signature verification before application dispatch.
Implement the ordered validation table with stable error classes.
Add one independent negative fixture per validation axis.

Specification Delta

Requirement: invalid private commands cannot reach the mutation adapter

Scenario: one command field is substituted

GIVEN an otherwise valid signed command
WHEN its peer, digest, principal, generation, expiry, or predecessor is wrong
THEN Vedanta denies it before calling the Kanidm adapter

OpenSpec

OpenSpec 20

Structural parent

Vedanta#20

## Proposal Authenticate OpenBao as the sole lifecycle caller and validate the complete signed command before any Kanidm mutation. ## Delivery class `agent-unit` — implement `src/private_api.rs` with request fixtures derived from the Session OpenSpec. ## Design The transport peer must be OpenBao's dedicated service identity. Validate signature, request window, fresh operation ID, action, grant ID/version/digest, principal UUID/name, state, auth and credential generations, requested expiry, and predecessor ownership in order. Caller-supplied grant content is never authority. ## Tasks - [ ] Add the typed command and result envelopes. - [ ] Add peer and signature verification before application dispatch. - [ ] Implement the ordered validation table with stable error classes. - [ ] Add one independent negative fixture per validation axis. ## Specification Delta ### Requirement: invalid private commands cannot reach the mutation adapter #### Scenario: one command field is substituted - **GIVEN** an otherwise valid signed command - **WHEN** its peer, digest, principal, generation, expiry, or predecessor is wrong - **THEN** Vedanta denies it before calling the Kanidm adapter ## OpenSpec [OpenSpec 20](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-20-openbao-forge-identity-lifecycle) ## Structural parent [Vedanta#20](https://jo.et0.pw/Ting/Vedanta/issues/20)

larandar added the

Kind/Feature

Kind/Security

labels

2026-08-29 19:53:25 +00:00

larandar referenced this issue

2026-08-29 19:53:27 +00:00

Session: OpenBao-owned Forge identity leases and private Vedanta effect #20

larandar added a new dependency

2026-08-29 19:53:54 +00:00

#20 Session: OpenBao-owned Forge identity leases and private Vedanta effect

larandar added a new dependency