Close OpenBao OIDC admin bootstrap path

sso-mfa/k8s/keycape/openbao-client-config.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Patch or verify the KeyCape openbao-admin client in a live Secret.
+"""Patch or verify non-secret KeyCape live config requirements.
 
 The script reads a Kubernetes Secret JSON object from stdin. It never prints the
 decoded KeyCape config or private key; stdout is either a JSON merge patch for
@@ -32,6 +32,11 @@ OPENBAO_CLIENT = {
     "clientType": "public",
 }
 
+LLDAP_REQUIRED = {
+    "userOU": "ou=people",
+    "groupOU": "ou=groups",
+}
+
 
 def load_config() -> dict[str, Any]:
     secret = json.load(sys.stdin)
@@ -83,8 +88,28 @@ def upsert_client(config: dict[str, Any]) -> dict[str, Any]:
     return config
 
 
+def lldap_errors(config: dict[str, Any]) -> list[str]:
+    lldap = config.get("lldap")
+    if not isinstance(lldap, dict):
+        return ["lldap must be a mapping"]
+    return [
+        f"lldap.{key} should be {expected!r}"
+        for key, expected in LLDAP_REQUIRED.items()
+        if lldap.get(key) != expected
+    ]
+
+
+def enforce_lldap_defaults(config: dict[str, Any]) -> dict[str, Any]:
+    lldap = config.get("lldap")
+    if not isinstance(lldap, dict):
+        lldap = {}
+        config["lldap"] = lldap
+    lldap.update(LLDAP_REQUIRED)
+    return config
+
+
 def render_patch(config: dict[str, Any]) -> None:
-    updated = upsert_client(config)
+    updated = enforce_lldap_defaults(upsert_client(config))
     config_text = yaml.safe_dump(updated, sort_keys=False)
     encoded = base64.b64encode(config_text.encode("utf-8")).decode("ascii")
     json.dump({"data": {"config.yaml": encoded}}, sys.stdout, separators=(",", ":"))
@@ -92,12 +117,12 @@ def render_patch(config: dict[str, Any]) -> None:
 
 
 def verify(config: dict[str, Any]) -> None:
-    errors = client_errors(config)
+    errors = client_errors(config) + lldap_errors(config)
     if errors:
         for error in errors:
             print(f"[FAIL] {error}")
         raise SystemExit(1)
-    print("[PASS] openbao-admin client has required CLI redirects, scopes, grant type, and public PKCE profile")
+    print("[PASS] openbao-admin client and LLDAP OU lookup settings are present")
 
 
 def main() -> None: