Document scope alignment and warden-sign readiness

catalog/warden-sign.yaml

@@ -53,6 +53,22 @@ auth_capability:
   token_num_uses: 0
   secret_id_ttl: 30m
   secret_id_num_uses: 1
+  oidc:
+    auth_mount: netkingdom
+    role_name: warden-sign
+    role_path: auth/netkingdom/role/warden-sign
+    login_command: bao login -method=oidc -path=netkingdom role=warden-sign
+    policies: [warden-sign]
+    ttl: 15m
+    user_claim: sub
+    groups_claim: groups
+    bound_claims:
+      groups: [net-kingdom-admins]
+    oidc_scopes: [openid, profile, email, groups]
+    allowed_redirect_uris:
+      - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
+      - http://localhost:8250/oidc/callback
+      - http://127.0.0.1:8250/oidc/callback
   allowed_paths:
     - path: ssh/sign/agt-role
       capabilities: [update]