FSA: Various Vault Authentication processes: OIDC-JWT

[Co1Mars]

---

Summary: Certificate Manager / FTA — Vault authentication via OIDC/JWT

Type: Story
Component: Certificate Manager / FTA
Labels: federation, vault, authentication, oidc, jwt, m2m

---

Description

The Certificate Manager / FTA must support OIDC/JWT as a Vault authentication method to accommodate deployment environments where AppRole is not preferred or where a trusted JWT issuer is already established. This allows the Certificate Manager to authenticate to Vault using short-lived JWTs, aligning with zero-trust principles and reducing reliance on long-lived static credentials.

---

Acceptance Criteria

• Certificate Manager authenticates to Vault using a JWT token via the Vault JWT/OIDC auth method
• JWT issuer, audience, and role are externally configurable without code changes
• Vault token is renewed before expiry; re-authentication from a fresh JWT is the fallback
• JWT source is configurable — supports both Keycloak client credentials and externally injected tokens
• Auth method is selectable via deployment profile (e.g. vault.auth.method=jwt)
• Authentication failure blocks dependent PKI operations and logs a structured error
• Implementation conforms to the shared VaultAuthProvider abstraction

---

Technical Notes

• Vault JWT login endpoint: POST /v1/auth/jwt/login with role and jwt parameters
• Spring @Profile-activated JwtVaultAuthProvider — consistent with the pattern established across the Management Node and AppRole auth stories
• JWT source in M2M context: short-lived token via Keycloak client credentials flow or injected by deployment pipeline; configurable via vault.auth.jwt.token-source
• Token lifecycle: renew using lease_duration; re-authenticate from a fresh JWT on renewal failure
• Configurable properties: vault.auth.method, vault.auth.jwt.issuer, vault.auth.jwt.audience, vault.auth.jwt.role, vault.auth.jwt.token-source, vault.auth.jwt.mount-path

---

Out of Scope

• AppRole and Token auth methods (separate stories)
• Management Node Vault auth (separate component)
• Human operator OIDC flows via Keycloak

---

Dependencies

• Vault/OpenBao JWT auth method enabled and configured at the node-local Vault instance
• VaultAuthProvider abstraction in place (shared across auth series)
• Trusted JWT issuer (e.g. Keycloak) configured and reachable

---

Definition of Done

• JWT authentication to Vault verified in integration test
• Token renewal and re-authentication fallback confirmed
• Profile-based auth method selection verified
• Auth failure blocks PKI operations — confirmed in test
• PR reviewed and merged