From 0f77ad534e6c35824fb461e58cf4dd69b93e3a8b Mon Sep 17 00:00:00 2001 From: Adnan Zahir Date: Tue, 1 Sep 2026 11:28:38 +0700 Subject: [PATCH] fix(openbao-session): use a token role for entity-alias minting entity-alias only works with -role; add OPENBAO_SESSION_ROLE so session tokens can carry the user entity (and read humans/self) via the openbao-session role. Bump 0.1.2. Co-Authored-By: Claude --- plugins/openbao-session/.claude-plugin/plugin.json | 2 +- plugins/openbao-session/.codex-plugin/plugin.json | 2 +- plugins/openbao-session/README.md | 9 ++++++++- plugins/openbao-session/hooks/bao-session.sh | 14 +++++++++----- 4 files changed, 19 insertions(+), 8 deletions(-) diff --git a/plugins/openbao-session/.claude-plugin/plugin.json b/plugins/openbao-session/.claude-plugin/plugin.json index a92cd58..5ced82f 100644 --- a/plugins/openbao-session/.claude-plugin/plugin.json +++ b/plugins/openbao-session/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "openbao-session", - "version": "0.1.1", + "version": "0.1.2", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "author": { "name": "Senkensha" }, "hooks": "./hooks/claude-codex-hooks.json" diff --git a/plugins/openbao-session/.codex-plugin/plugin.json b/plugins/openbao-session/.codex-plugin/plugin.json index b156af1..f1be640 100644 --- a/plugins/openbao-session/.codex-plugin/plugin.json +++ b/plugins/openbao-session/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "openbao-session", - "version": "0.1.1+codex.20260901111859", + "version": "0.1.2+codex.20260901112838", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "author": { "name": "Local developer" diff --git a/plugins/openbao-session/README.md b/plugins/openbao-session/README.md index acbd2dd..611c82a 100644 --- a/plugins/openbao-session/README.md +++ b/plugins/openbao-session/README.md @@ -49,7 +49,13 @@ path "humans/metadata/{{identity.entity.id}}/*" { capabilities = ["read", "list" EOF bao policy write claude-session /tmp/claude-session.hcl -# 3. Issue bootstrap token (TTL panjang, renewable) dan simpan NILAINYA ke secrets store LOKAL: +# 3. Token roles (wajib utk -entity-alias). Perluas allowed_entity_aliases sesuai tim. +bao write auth/token/roles/openbao-session \ + allowed_policies=claude-session \ + allowed_entity_aliases=adnan,rizal \ + ttl=4h renewable=true + +# 4. Issue bootstrap token (TTL panjang, renewable) dan simpan NILAINYA ke secrets store LOKAL: bao token create -policy=openbao-session-creator -ttl=720h -renewable \ -display-name=openbao-session-bootstrap -format=json # → ambil auth.client_token, lalu di Mac Anda: @@ -83,6 +89,7 @@ python3 ~/.config/devops-secrets/manage.py set openbao bootstrap_token --descrip | `OPENBAO_SESSION_POLICY` | `claude-session` | policy token sesi | | `OPENBAO_SESSION_TTL` | `4h` | umur token sesi | | `OPENBAO_SESSION_ENTITY` | *(kosong)* | nama entity OpenBao pemakai (mis. `adnan`, `rizal`) → token sesi diikat ke entity (aktifkan `humans/self`) | +| `OPENBAO_SESSION_ROLE` | *(kosong)* | token role utk sesi (mis. `openbao-session`). Wajib diisi jika `OPENBAO_SESSION_ENTITY` diset (`-entity-alias` hanya bekerja dgn `-role`) | | `OPENBAO_SESSION_BAO_VER` | `2.6.2` | versi binary bao (auto-download jika belum ada) | | `OPENBAO_SESSION_SECRETS_HELPER` | `~/.config/devops-secrets/manage.py` | helper baca bootstrap | | `OPENBAO_SESSION_BOOTSTRAP_TOOL` / `_KEY` | `openbao` / `bootstrap_token` | lokasi bootstrap di secrets store | diff --git a/plugins/openbao-session/hooks/bao-session.sh b/plugins/openbao-session/hooks/bao-session.sh index 1bb960c..4427c0b 100755 --- a/plugins/openbao-session/hooks/bao-session.sh +++ b/plugins/openbao-session/hooks/bao-session.sh @@ -37,6 +37,7 @@ BAO_VER="${OPENBAO_SESSION_BAO_VER:-2.6.2}" SESSION_POLICY="${OPENBAO_SESSION_POLICY:-claude-session}" SESSION_TTL="${OPENBAO_SESSION_TTL:-4h}" SESSION_ENTITY="${OPENBAO_SESSION_ENTITY:-}" # OpenBao entity name; ties the session token to the user (enables humans/self via {{identity.entity.id}}) +SESSION_ROLE="${OPENBAO_SESSION_ROLE:-}" # token role (required when SESSION_ENTITY is set; entity-alias only works with a role) SECRETS_HELPER="${OPENBAO_SESSION_SECRETS_HELPER:-$HOME/.config/devops-secrets/manage.py}" BOOTSTRAP_TOOL="${OPENBAO_SESSION_BOOTSTRAP_TOOL:-openbao}" BOOTSTRAP_KEY="${OPENBAO_SESSION_BOOTSTRAP_KEY:-bootstrap_token}" @@ -102,14 +103,17 @@ read_bootstrap() { mint_session_token() { local bootstrap json - local -a entity_args=() + local -a create_args=() bootstrap="$(read_bootstrap)" || return 1 - if [ -n "$SESSION_ENTITY" ]; then - entity_args+=("-entity-alias=$SESSION_ENTITY") + if [ -n "$SESSION_ROLE" ]; then + # token role governs policy + allows entity-alias (entity-alias needs a role) + create_args+=(-role="$SESSION_ROLE") + [ -n "$SESSION_ENTITY" ] && create_args+=(-entity-alias="$SESSION_ENTITY") + else + create_args+=(-policy="$SESSION_POLICY" -ttl="$SESSION_TTL") fi json="$(BAO_ADDR="$BAO_ADDR_URL" BAO_CACERT="$CACERT" BAO_TLS_SERVER_NAME="$TLS_NAME" BAO_TOKEN="$bootstrap" \ - "$BAO_BIN" token create -policy="$SESSION_POLICY" -ttl="$SESSION_TTL" -renewable \ - "${entity_args[@]}" \ + "$BAO_BIN" token create "${create_args[@]}" -renewable \ -display-name="openbao-session-$(hostname)" -format=json)" || { log "token create failed"; return 1; } SESSION_TOKEN="$(printf '%s' "$json" | jq -r '.auth.client_token // empty')" [ -n "$SESSION_TOKEN" ] || { log "no client_token in token create response"; return 1; }