Repository navigation
feat(sso): client-secret rotation — rewrap_dek + value re-seal + warn-on-stale #10154
Description
Phase C2 of #8994. Depends on C1.
Rotation = (a) KEK rotation via envelope rewrap_dek (no payload re-encrypt); (b) value rotation via re-seal when operator rotates at the IdP. Default 90-day advisory cadence, warn-on-stale, never hard-expire (spec §4). Admin-initiated always available. Audit each rotation.
AC:
- rewrap_dek KEK rotation (plaintext unchanged)
- value re-seal rotation
- warn-on-stale surfaced in SSOSettings.vue
- audit row per rotation
- tests
Design: docs/superpowers/specs/2026-06-15-enterprise-sso-federation-design.md (branch issue-8994). Parent sub-umbrella #8994 (under umbrella #9930).
Activity
mrveiss commentedon Jun 21, 2026
BLOCKED on #10437 (expose
rewrap_dekKEK-rotation on UnifiedSecretsService/API) and on C1 #10153.rotate_valuerequires new plaintext; KEK-rotation-without-value-change is not surfaced.feat(sso): migrate SSO secrets to unified vault + rotation (#10153, #…
mrveiss commentedon Jun 26, 2026
Merged to
Dev_new_gui(5f2e83cc3, PR #10498). SSO secret rotation:rotate-kek(via #10437rewrap_dek— rotate KEK, keep value) +rotate-value(re-seal new secret) endpoints (SECURITY_MANAGE-gated),{field}_rotated_attracking +check_stalenesswarn-on-stale (SSO_SECRET_MAX_AGE_DAYSenv, default 90d) surfaced on the provider-health response. 24 tests pass. Batch #10440.fix(sso): service-auth KEK rewrap endpoint + review hardening (#10154, …