From ddbdf468e33fe75e3d1668bea5b89f73e240c1ed Mon Sep 17 00:00:00 2001 From: Adnan Zahir Date: Tue, 1 Sep 2026 11:35:31 +0700 Subject: [PATCH] docs(openbao-session): creator policy needs auth/token/create/* for role-based minting Co-Authored-By: Claude --- plugins/openbao-session/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/openbao-session/README.md b/plugins/openbao-session/README.md index 611c82a..b7ecc45 100644 --- a/plugins/openbao-session/README.md +++ b/plugins/openbao-session/README.md @@ -27,11 +27,15 @@ export BAO_ADDR=https://10.104.0.12:8200 export BAO_CACERT=/opt/openbao/tls/tls.crt export BAO_TOKEN= # jangan di-paste ke chat -# 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret +# 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret. +# Wajib menyertakan auth/token/create/* agar pembuatan token via -role (entity-alias) diizinkan. cat > /tmp/openbao-session-creator.hcl <<'EOF' path "auth/token/create" { capabilities = ["create", "update", "sudo"] } +path "auth/token/create/*" { + capabilities = ["create", "update", "sudo"] +} path "auth/token/renew-self" { capabilities = ["update"] } path "auth/token/revoke-self" { capabilities = ["update"] } path "auth/token/lookup-self" { capabilities = ["read"] }