Jon Chery
0f7f9cf914
---ci--- project: orca phase: 27 milestone: v0.12 status: execute ---/ci--- docs/threat-model.md (STRIDE + OS surface + residual risks), docs/oidc.md (bundled Dex + BYO + claim mapping + offline), docs/webauthn.md (passkeys + RP ID + bootstrap sequence), docs/security-runbook.md (seal/unseal + rotation + incident response).
32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
# OIDC Configuration (v0.12)
|
|
|
|
## Bundled Dex (default)
|
|
|
|
`orca auth init-idp --rp-id <cluster-domain>` bootstraps a local Dex
|
|
on the lead, fronted by Traefik (step-ca cert). The WebAuthn connector
|
|
provides password-free passkey registration + login.
|
|
|
|
## BYO External IdP
|
|
|
|
Set `oidc.issuer` in config to repoint to Keycloak/Authentik/Google/etc.
|
|
The bundled Dex is bypassed; the external IdP's authenticators are used.
|
|
|
|
## Claim-to-Namespace Mapping
|
|
|
|
OIDC `sub` (subject) maps to an ACL entry. Groups (`groups` claim) map
|
|
to group-based grants. `orca acl grant <ns> --oidc-sub <sub> --perm read`
|
|
or `orca acl grant <ns> --oidc-group <group> --perm admin`.
|
|
|
|
## Offline / Air-Gapped
|
|
|
|
Run the bundled Dex on the lead (offline). For the single-operator
|
|
fully-offline case, skip OIDC and rely on mTLS-only machine identity
|
|
(no human authn needed; the operator holds the pre-staged SSH key +
|
|
mTLS cert; no password, no token).
|
|
|
|
## Credentials Storage
|
|
|
|
`~/.orca/credentials.json` (0600). Short-lived ID token (1h) + refresh.
|
|
The IdP issues tokens; Orca only stores them. No long-lived
|
|
Orca-issued tokens (R-021).
|