What does sluis protect, and how?¶
sluis protects three things: the decision about who holds a token, the signing key behind every token, and the credentials its modules hold. Report a vulnerability as SECURITY says.
What it trusts¶
sluis verifies proofs produced elsewhere: a directory sign-in, a platform's job token, a cluster's ServiceAccount token. It holds no users and no MFA. Two accounts sign in with a password, the recovery account and a conformance test account. SRP-6a proves it, so the password never reaches the service (recovery). A removal acts only on an authoritative answer (failure semantics).
A browser sign-in¶
| Boundary | What holds it |
|---|---|
| The request belongs to the browser that started it | /authorize sets a cookie that holds a MAC of the request id. Another browser cannot finish it |
| A code needs its verifier | PKCE is required for public clients, and per client with pkce: required. A code issued against a challenge is redeemed with its code_verifier |
| A redirect is a registered redirect | A native client's loopback redirect differs in the port only |
| Sign-out needs a click | /logout and /end_session ask first, unless the id_token_hint names the signed-in person |
| The page cannot be framed or sniffed | Every response carries a content security policy, X-Frame-Options: DENY and nosniff; HSTS is sent on https |
| A client's own document is untrusted | It is fetched from an allowed origin to public addresses only, and it may declare no client secret |
A Google sign-in needs a verified address and its own nonce, and google.oauthClient.hostedDomains limits the domains. An address stays with the Google account that first signed in with it. The full list is endpoints: hardening.
A token¶
- A repeated security parameter is refused.
/revokeends only what the authenticated client was issued.- A refreshed ID token keeps its
acrandamr. - An exchange is decided by policy: a GitHub Actions job can be pinned to numeric owner and repository ids with
exchange.github.ownerIdsandrepositoryIds.
Keys and credentials¶
Each module holds only its own credentials, and the boundary sits in IAM per role (ADR 0071). On AWS the signing key's control plane belongs to named administrator and break-glass roles. Every SecureString lives under the installation's key (signing on AWS).
Backups and the audit trail¶
A backup is age-encrypted. A restore checks the backup against the sealed audit trail and compares its recipients with backup.recipients (back up and restore). A refused audit read is recorded. A record is held to the source its caller is listed for (audit).
Releases¶
A release carries keyless signatures, provenance and SBOM attestations, and signed checksums. The Pulumi library verifies the checksums' signature before it trusts a digest (verify a release).