OpenBao key-custody backend (uniform AD + Keycloak) #29

New issue

Open

opened 2026-07-25 17:43:56 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-25 17:43:56 +00:00

Owner

Manuel's suggestion for the open AD key-management question. Add a third KeyProvider backing per-user age keys in OpenBao (the active Linux-Foundation Vault fork; its transit engine is "encryption/keys as a service" — per-key derivation, convergent encryption, rotation, audit logs).

Gives uniform key custody across both Keycloak and AD users (AD has no writable profile attributes — the current gap).
Answers the custody-storage question (where keys live), not the access question (the backend still fetches/holds the key at runtime).
New dependency/service — weigh against the tiny-trust-surface goal (§1.4).

Source: https://openbao.org/docs/secrets/transit/

Manuel's suggestion for the open AD key-management question. Add a third `KeyProvider` backing per-user age keys in **OpenBao** (the active Linux-Foundation Vault fork; its **transit engine** is "encryption/keys as a service" — per-key derivation, convergent encryption, rotation, audit logs). - Gives **uniform** key custody across both Keycloak *and* AD users (AD has no writable profile attributes — the current gap). - Answers the *custody-storage* question (where keys live), **not** the *access* question (the backend still fetches/holds the key at runtime). - New dependency/service — weigh against the tiny-trust-surface goal (§1.4). Source: https://openbao.org/docs/secrets/transit/

Cordy added this to the v0.4 — Real competitor (parity + hardening) milestone

2026-07-25 17:43:56 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#29

No description provided.

Rows
Columns