ba4c935182
- Added support for bootstrap providers in AuthorityIdentityProviderRegistry. - Introduced a new property for bootstrap providers and updated AggregateCapabilities. - Updated relevant methods to handle bootstrap capabilities during provider registration. feat: Introduce Sealed Mode Status in OpenIddict Handlers - Added SealedModeStatusProperty to AuthorityOpenIddictConstants. - Enhanced ValidateClientCredentialsHandler, ValidatePasswordGrantHandler, and ValidateRefreshTokenGrantHandler to validate sealed mode evidence. - Implemented logic to handle airgap seal confirmation requirements. feat: Update Program Configuration for Sealed Mode - Registered IAuthoritySealedModeEvidenceValidator in Program.cs. - Added logging for bootstrap capabilities in identity provider plugins. - Implemented checks for bootstrap support in API endpoints. chore: Update Tasks and Documentation - Marked AUTH-MTLS-11-002 as DONE in TASKS.md. - Updated documentation to reflect changes in sealed mode and bootstrap capabilities. fix: Improve CLI Command Handlers Output - Enhanced output formatting for command responses and prompts in CommandHandlers.cs. feat: Extend Advisory AI Models - Added Response property to AdvisoryPipelineOutputModel for better output handling. fix: Adjust Concelier Web Service Authentication - Improved JWT token handling in Concelier Web Service to ensure proper token extraction and logging. test: Enhance Web Service Endpoints Tests - Added detailed logging for authentication failures in WebServiceEndpointsTests. - Enabled PII logging for better debugging of authentication issues. feat: Introduce Air-Gap Configuration Options - Added AuthorityAirGapOptions and AuthoritySealedModeOptions to StellaOpsAuthorityOptions. - Implemented validation logic for air-gap configurations to ensure proper setup.
64 lines
1.6 KiB
YAML
64 lines
1.6 KiB
YAML
schemaVersion: 1
|
|
issuer: http://authority.sealed-ci.local
|
|
accessTokenLifetime: 00:02:00
|
|
refreshTokenLifetime: 01:00:00
|
|
identityTokenLifetime: 00:05:00
|
|
authorizationCodeLifetime: 00:05:00
|
|
deviceCodeLifetime: 00:15:00
|
|
pluginDirectories:
|
|
- /app
|
|
plugins:
|
|
configurationDirectory: /app/plugins
|
|
descriptors:
|
|
standard:
|
|
type: standard
|
|
assemblyName: StellaOps.Authority.Plugin.Standard
|
|
enabled: true
|
|
configFile: standard.yaml
|
|
storage:
|
|
connectionString: mongodb://sealedci:sealedci@mongo:27017/authority?authSource=admin
|
|
databaseName: authority
|
|
commandTimeout: 00:00:30
|
|
signing:
|
|
enabled: true
|
|
activeKeyId: sealed-ci
|
|
keyPath: /certificates/authority-signing-dev.pem
|
|
algorithm: ES256
|
|
keySource: file
|
|
bootstrap:
|
|
enabled: false
|
|
crypto:
|
|
providers: []
|
|
security:
|
|
senderConstraints:
|
|
dpop:
|
|
enabled: true
|
|
proofLifetime: 00:02:00
|
|
replayWindow: 00:05:00
|
|
nonce:
|
|
enabled: false
|
|
mtls:
|
|
enabled: false
|
|
airGap:
|
|
egress:
|
|
mode: Sealed
|
|
allowLoopback: true
|
|
allowPrivateNetworks: true
|
|
remediationDocumentationUrl: https://docs.stella-ops.org/airgap/sealed-ci
|
|
supportContact: airgap-ops@stella-ops.org
|
|
sealedMode:
|
|
enforcementEnabled: true
|
|
evidencePath: /artifacts/sealed-mode-ci/latest/authority-sealed-ci.json
|
|
maxEvidenceAge: 00:30:00
|
|
cacheLifetime: 00:01:00
|
|
requireAuthorityHealthPass: true
|
|
requireSignerHealthPass: true
|
|
requireAttestorHealthPass: true
|
|
requireEgressProbePass: true
|
|
tenants:
|
|
- name: sealed-ci
|
|
roles:
|
|
operators:
|
|
scopes:
|
|
- policy:read
|