Files

T

Jon Chery 0f7f9cf914 docs(P27): zero-trust + OIDC + WebAuthn + threat-model docs (REQ-142)

---ci---
project: orca
phase: 27
milestone: v0.12
status: execute
---/ci---

docs/threat-model.md (STRIDE + OS surface + residual risks),
docs/oidc.md (bundled Dex + BYO + claim mapping + offline),
docs/webauthn.md (passkeys + RP ID + bootstrap sequence),
docs/security-runbook.md (seal/unseal + rotation + incident response).

2026-08-07 11:33:58 +00:00

1.1 KiB

Raw Blame History

OIDC Configuration (v0.12)

Bundled Dex (default)

orca auth init-idp --rp-id <cluster-domain> bootstraps a local Dex on the lead, fronted by Traefik (step-ca cert). The WebAuthn connector provides password-free passkey registration + login.

BYO External IdP

Set oidc.issuer in config to repoint to Keycloak/Authentik/Google/etc. The bundled Dex is bypassed; the external IdP's authenticators are used.

Claim-to-Namespace Mapping

OIDC sub (subject) maps to an ACL entry. Groups (groups claim) map to group-based grants. orca acl grant <ns> --oidc-sub <sub> --perm read or orca acl grant <ns> --oidc-group <group> --perm admin.

Offline / Air-Gapped

Run the bundled Dex on the lead (offline). For the single-operator fully-offline case, skip OIDC and rely on mTLS-only machine identity (no human authn needed; the operator holds the pre-staged SSH key + mTLS cert; no password, no token).

Credentials Storage

~/.orca/credentials.json (0600). Short-lived ID token (1h) + refresh. The IdP issues tokens; Orca only stores them. No long-lived Orca-issued tokens (R-021).

1.1 KiB Raw Blame History