feat: split key

certificates/client_server/ca/ca.srl

@@ -1 +1 @@
-640BF08B2D2C8FC41FC2300EF05F7A989419005F
+640BF08B2D2C8FC41FC2300EF05F7A9894190060

certificates/client_server/co3/co3.client.acme.com.crt

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE-----
-MIIDhjCCAm6gAwIBAgIUZAvwiy0sj8QfwjAO8F96mJQZAF8wDQYJKoZIhvcNAQEL
+MIIDhjCCAm6gAwIBAgIUZAvwiy0sj8QfwjAO8F96mJQZAGAwDQYJKoZIhvcNAQEL
 BQAwWjELMAkGA1UEBhMCRlIxDDAKBgNVBAgMA0lkRjEOMAwGA1UEBwwFUGFyaXMx
 ETAPBgNVBAoMCEFjbWVUZXN0MRowGAYDVQQDDBFBY21lIFRlc3QgUm9vdCBDQTAe
-Fw0yNjA4MTMxMTU0NTBaFw0zNjA4MTAxMTU0NTBaMFwxCzAJBgNVBAYTAkZSMQww
+Fw0yNjA4MTMxODI5NTNaFw0zNjA4MTAxODI5NTNaMFwxCzAJBgNVBAYTAkZSMQww
 CgYDVQQIDANJZEYxDjAMBgNVBAcMBVBhcmlzMREwDwYDVQQKDAhBY21lVGVzdDEc
 MBoGA1UEAwwTY28zLmNsaWVudEBhY21lLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
 ggEPADCCAQoCggEBALl3txZ9MNI7mJ5Y6UkvjPlKOiA92NJZSsuvwD6ZzfHXC0EP
@@ -12,10 +12,10 @@ PeXeU25Ft0DCFXawE1g/a0+CefpGJ6ee8YH5Ne0CwkOecmfW4/ou4dEjnVzX5N7O
 sHPUUsN26TSZp0dcyBax3ws1ZUDGbKtVngC85+JWkLi9t4+NeA+wVhiJfiP3I2ko
 4trF9Q7s/20HjG6hwwt0JdUpGZG3n50w6lh6bEsCAwEAAaNCMEAwHQYDVR0OBBYE
 FPDF8CLmuTR3/P38UVZndL035uWlMB8GA1UdIwQYMBaAFCrsQdVEgrwm8ED+4pCs
-lsN3SX3/MA0GCSqGSIb3DQEBCwUAA4IBAQB5ZxqHo5SucStiqn8Z4x0XEWntliTE
-s3QEIUl01icjoRdZfFrhLxS7sKp0wbOvxfzsIl3lHAXxxcPW6rQdKcuWwNYY6cOY
-B9dfTJbVgGGaAg1vczqCFQ55XOqYkzua7UeZWPUTTpUPI9cD4pEHr25yGgcLs3Jt
-yGWkyP3iZEVXHSYCRkDKUMugyC5R29aCjoCyA1sbA2A7PkHz9RB61S7srhYl64Ui
-/lC30jOkAH4Rvl8IylISJzfut1WVM9U5qfclCYXCfSDm/BF+68aRePw06ICE0A4+
-RayVj57mkBTePSpcS2c05eFVOyyrRWul1whq0uy9dJN6dWa3m7gh5q8C
+lsN3SX3/MA0GCSqGSIb3DQEBCwUAA4IBAQCi2DoSBefV3t6TRiEDqUT/sufFKbb+
+2Ddl2Gz3Ev5lG854VkkmwzDbHuIy0PvdnseRHetKE8U/Avt+o6KWJCEblBw85Q5Q
+FmvOoXtD9YdrQediOr5m6ARKTwjHb5C7vwTQluXL16SuC9ATVWBW5/osaoAu+G7w
+OYhcLnSwj15Faf+sL7kdD+k1497xTlzdlQK0g5Cw523IKxwqqrp51or9d9XEKRcO
+u0w+3pJJvjkE8hoKTQ1o1cXVxl28q+dZAKd9ThdTEKIkqzdcTRJpV7rXwucY1UOu
+yh3Sfh/RDTKlCCNshDfJJ2nNQjRSPNKgjnVrB4s6mlSbjmSBfrZud2Td
 -----END CERTIFICATE-----

certificates/client_server/generate_certs.sh

@@ -1,56 +1,81 @@
 #!/bin/bash
+set -euo pipefail
 
-# on MacOS, you should pass a link to an actually installed openssl binary, and not use the default `libressl`
-# which generates PKCS12 files with the deprecated RC2 algorithm
+# On macOS, pass the path to a modern OpenSSL binary as the first argument.
+# The system `libressl` generates PKCS12 files with the deprecated RC2 algorithm.
 OPENSSL_BIN=${1:-openssl}
 
-# Generate CA private key
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ca.key
-
-# Generate self-signed CA certificate
-$OPENSSL_BIN req -new -x509 -days 3650 -key ca.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=Acme Test Root CA" -out ca.crt
-
-
-## Server Cert
-
-# Generate private key for kmserver.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out kmserver.acme.com.key
-
-# Generate certificate signing request for kmserver.acme.com
-$OPENSSL_BIN req -new -key kmserver.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=kmserver.acme.com" -out kmserver.acme.com.csr
-
-# Generate certificate for kmserver.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in kmserver.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out kmserver.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out kmserver.acme.com.p12 -inkey kmserver.acme.com.key -in kmserver.acme.com.crt -certfile ca.crt -password pass:password
-
-
-## "owner" client cert
-
-# Generate private key for owner.client.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out owner.client.acme.com.key
-
-# Generate certificate signing request for owner.client.acme.com
-$OPENSSL_BIN req -new -key owner.client.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=owner.client@acme.com" -out owner.client.acme.com.csr
-
-# Generate certificate for owner.client.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in owner.client.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out owner.client.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out owner.client.acme.com.p12 -inkey owner.client.acme.com.key -in owner.client.acme.com.crt -certfile ca.crt -password pass:password
-
-
-## "user" client cert
-
-# Generate private key for user.client.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out user.client.acme.com.key
-
-# Generate certificate signing request for user.client.acme.com
-$OPENSSL_BIN req -new -key user.client.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=user.client@acme.com" -out user.client.acme.com.csr
-
-# Generate certificate for user.client.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in user.client.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out user.client.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out user.client.acme.com.p12 -inkey user.client.acme.com.key -in user.client.acme.com.crt -certfile ca.crt -password pass:password
+# ---------------------------------------------------------------------------
+# generate_cert BASENAME CN OUTDIR [CADIR] [PASSOUT]
+#
+# Issues a CA-signed RSA-2048 certificate and writes four files under OUTDIR:
+#   BASENAME.key   private key
+#   BASENAME.csr   certificate signing request
+#   BASENAME.crt   signed certificate
+#   BASENAME.p12   PKCS12 bundle (password = PASSOUT, empty string = no password)
+#
+# Arguments:
+#   BASENAME  filename stem, e.g. "owner.client.acme.com"
+#   CN        X.509 Common Name, e.g. "owner.client@acme.com"
+#   OUTDIR    output directory, e.g. "owner"
+#   CADIR     directory containing ca.crt / ca.key (default: "ca")
+#   PASSOUT   PKCS12 export password (default: empty = no password)
+# ---------------------------------------------------------------------------
+generate_cert() {
+    local basename="$1"
+    local cn="$2"
+    local outdir="$3"
+    local cadir="${4:-ca}"
+    local passout="${5:-password}"
+
+    mkdir -p "$outdir"
+
+    local key="${outdir}/${basename}.key"
+    local csr="${outdir}/${basename}.csr"
+    local crt="${outdir}/${basename}.crt"
+    local p12="${outdir}/${basename}.p12"
+
+    echo "── Generating ${cn} (${outdir}) ──"
+
+    "$OPENSSL_BIN" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
+        -out "$key"
+
+    "$OPENSSL_BIN" req -new -key "$key" \
+        -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=${cn}" \
+        -out "$csr"
+
+    "$OPENSSL_BIN" x509 -req -days 3650 \
+        -in "$csr" -CA "${cadir}/ca.crt" -CAkey "${cadir}/ca.key" -CAcreateserial \
+        -out "$crt"
+
+    "$OPENSSL_BIN" pkcs12 -export \
+        -out "$p12" -inkey "$key" -in "$crt" -certfile "${cadir}/ca.crt" \
+        -passout "pass:${passout}"
+}
+
+
+# ---------------------------------------------------------------------------
+# CA
+# ---------------------------------------------------------------------------
+mkdir -p ca
+echo "── Generating CA ──"
+"$OPENSSL_BIN" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ca/ca.key
+"$OPENSSL_BIN" req -new -x509 -days 3650 -key ca/ca.key \
+    -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=Acme Test Root CA" \
+    -out ca/ca.crt
+
+
+# ---------------------------------------------------------------------------
+# Server cert
+# ---------------------------------------------------------------------------
+generate_cert "kmserver.acme.com" "kmserver.acme.com" "server"
+
+
+# ---------------------------------------------------------------------------
+# Client certs
+# ---------------------------------------------------------------------------
+generate_cert "owner.client.acme.com" "owner.client@acme.com" "owner"
+generate_cert "user.client.acme.com"  "user.client@acme.com"  "user"
+generate_cert "co3.client.acme.com"   "co3.client@acme.com"   "co3"
+
+echo "Done."

certificates/csr/ca.srl

@@ -1 +1 @@
-184F7763E7B126D3F188B20D137DD2B2B2756744
+184F7763E7B126D3F188B20D137DD2B2B2756745

certificates/csr/extensions.ext

@@ -1,4 +1,4 @@
 [ v3_ca ]
 basicConstraints=CA:TRUE,pathlen:0
-keyUsage=keyCertSign,digitalSignature
+keyUsage=keyCertSign,cRLSign,digitalSignature
 extendedKeyUsage=emailProtection

certificates/csr/generate.sh

@@ -44,10 +44,12 @@ openssl req -new -key intermediate.key -out intermediate.csr -subj "/C=FR/ST=IdF
 # ```
 # [ v3_ca ]
 # basicConstraints=CA:TRUE,pathlen:0
-# keyUsage=keyCertSign,digitalSignature
+# keyUsage=keyCertSign,cRLSign,digitalSignature
 # extendedKeyUsage=emailProtection
 # crlDistributionPoints=URI:http://cse.example.com/crl.pem
 # ```
+# `cRLSign` is required by RFC 5280 §4.2.1.3 for any CA that issues CRLs —
+# without it the KMS server rejects CRL generation requests for this issuer.
 # The `crlDistributionPoints` option should be replaced with the URL of a publicly accessible HTTP uniformResourceIdentifier that contains the CRL for the intermediate certificate.
 # This will sign the CSR with the CA's private key and generate an intermediate certificate. The intermediate certificate will be stored in the file `intermediate.crt`.
 openssl x509 -req -in intermediate.csr -CA ca.crt -CAkey ca.key -out intermediate.crt -days 1825 -extensions v3_ca -extfile extensions.ext

certificates/csr/intermediate.crt

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE-----
-MIIExzCCAy+gAwIBAgIUGE93Y+exJtPxiLINE33SsrJ1Z0QwDQYJKoZIhvcNAQEL
+MIIExzCCAy+gAwIBAgIUGE93Y+exJtPxiLINE33SsrJ1Z0UwDQYJKoZIhvcNAQEL
 BQAwXTELMAkGA1UEBhMCRlIxDDAKBgNVBAgMA0lkRjEOMAwGA1UEBwwFUGFyaXMx
 EDAOBgNVBAoMB0Nvc21pYW4xDDAKBgNVBAsMA1ImRDEQMA4GA1UEAwwHVGVzdCBD
-QTAeFw0yNjA2MDcwNzQ4NDFaFw0zMTA2MDYwNzQ4NDFaMGcxCzAJBgNVBAYTAkZS
+QTAeFw0yNjA4MjMxODU0NDlaFw0zNjA4MjAxODU0NDlaMGcxCzAJBgNVBAYTAkZS
 MQwwCgYDVQQIDANJZEYxDjAMBgNVBAcMBVBhcmlzMRAwDgYDVQQKDAdDb3NtaWFu
 MQwwCgYDVQQLDANSJkQxGjAYBgNVBAMMEVRlc3QgSW50ZXJtZWRpYXRlMIIBojAN
 BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8fqz6gS1zKOw0ITYtiQZyfBJ0j2z
@@ -14,15 +14,15 @@ mT2jjBjl2A9U2Nt9pB/htRwK1T1arK6hsgzSOd6C9J4oV6QPZRuZgLdOWy5Tcnyz
 nhPaLzKnKZrmb8u4SpkIboIFD9L4Z2uBGM1QyHNFbznV13ph37QbQAb1/gdgFmvT
 RjU/4K0sWSPyCJ6z3iq7blwH4VpXSrCVe5eNkoEhx4+oFtJA6InR33On7zBFAvln
 Ru9er+PmddNGMcCDYkFqZvyre3rDeec/hTIvAgMBAAGjdTBzMA8GA1UdEwQIMAYB
-Af8CAQAwCwYDVR0PBAQDAgKEMBMGA1UdJQQMMAoGCCsGAQUFBwMEMB0GA1UdDgQW
+Af8CAQAwCwYDVR0PBAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMEMB0GA1UdDgQW
 BBQEK8XsqNesHDBu2Xz6rEdg09OK9DAfBgNVHSMEGDAWgBQJbsVPDK4X9gjOFhy+
-sVf/0DzKGDANBgkqhkiG9w0BAQsFAAOCAYEAlhNiN9Lktl+wx/BN/sDPSm2a/4xI
-ZpjUj/Yrnp1KWMmj9hgmPZx89XSbrW42FxKLId5o9+eCWrVZDQowlnVjrokgM3WM
-wcQ67lqg50vW25UOni5HKFF0vDZiMBP+KVUYvGI1P10JM/6aayGl5r+gxqnDI1m8
-72mO8M4Q/nN7DEzZQ3tCnWo6b2wbHsrRRo1LYqTx4QDL4M2EQ/yseC9qCC8N0JPH
-fQU7Crq89+VdEnq9WFemnoiEvOU7fpyh884SegmFGKojzW8QU5xMbzcooZseYdTD
-mBTzavPwiU2evs6/YDJO5s9mZTtI/GRhBtHqIVnollMzxEYebcmB5Xy0dB4j0tsi
-38UyjlO8QIXo2wQ0xaKD4dDksmvKPKcJgJsX21bMdbGHUMrMYm8qcyvPRr+HNm2j
-+njI1i6RTL2qbcqVON9zlxYUYBcYto6GCvufOIna/eVlnKd4R761JtwbHHPZOIdh
-Ilq5N2JdqLVERca4700lEht+R2+TESLEKFM+
+sVf/0DzKGDANBgkqhkiG9w0BAQsFAAOCAYEAVgVqVapRDa0rY1nNJ7qot25mdCA3
+ve/j9YcifNpYtk75cMu3+lz7M/DVLyVxbF71O2cc8hQP9pnMATXSxXbsVxvpwsTU
+i2d5tvgGRvgJT2Wtkw+5nlrmW5X1SI1mqhB1B2DUhE42r7FDWGcieocowXTPyiuo
+zEOMD6Blfx+OJwK2ovnGsaqTcANSrMl1K7ABaelktHkXD+QXa6g9bq5cPdg7QZBH
+CsaQKLRmLWg4eZ5W7MeNuTyomMhHABB7MWk3FHqXBEyfg6R8MkzJv7zz5DMELco4
+DZtIZN2rEJodY/0GSk4lvbOsJEBpjm+aXLISzffO7cfxzNgQmF0FVzff0pRHCp9e
+Kb5lLaZBia7XaK94QYWh4p17NdbNWaZIxhyx2C1vSvJc7lUdkisyeCowY+nZgD8w
+JkKV0hcyAP5WQubP9oVkN2DI/XtBI9YlvlXRgJJvCkMZXPFP72Hwe3afbRzOq1kt
+4O9nRSNxmvhKMT6rD0nLZ2pBJqumxlA8KXvK
 -----END CERTIFICATE-----

certificates/csr/intermediate.srl

@@ -1 +1 @@
-459C68F5070C2DCB2E6F84F7D0E396B9AD5417F1
+459C68F5070C2DCB2E6F84F7D0E396B9AD5417F2

certificates/csr/leaf.crt

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE-----
-MIIEyTCCAzGgAwIBAgIURZxo9QcMLcsub4T30OOWua1UF/EwDQYJKoZIhvcNAQEL
+MIIEyTCCAzGgAwIBAgIURZxo9QcMLcsub4T30OOWua1UF/IwDQYJKoZIhvcNAQEL
 BQAwZzELMAkGA1UEBhMCRlIxDDAKBgNVBAgMA0lkRjEOMAwGA1UEBwwFUGFyaXMx
 EDAOBgNVBAoMB0Nvc21pYW4xDDAKBgNVBAsMA1ImRDEaMBgGA1UEAwwRVGVzdCBJ
-bnRlcm1lZGlhdGUwHhcNMjYwNjA3MDc0ODUyWhcNMzEwNjA2MDc0ODUyWjBfMQsw
+bnRlcm1lZGlhdGUwHhcNMjYwODIzMTg1NDQ5WhcNMzYwODIwMTg1NDQ5WjBfMQsw
 CQYDVQQGEwJGUjEMMAoGA1UECAwDSWRGMQ4wDAYDVQQHDAVQYXJpczEQMA4GA1UE
 CgwHQ29zbWlhbjEMMAoGA1UECwwDUiZEMRIwEAYDVQQDDAlUZXN0IExlYWYwggGi
 MA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCRHCUJdbJoDRdYOQw4LMsz08Iu
@@ -14,15 +14,15 @@ BAuzTranVkPW+ZqsNJ2ct5i/vwQNtvdg4PUPUjLQ0knOnpuJsHHm7V66ZfPluFJn
 fb+fRkRf60jwKjf8LydqiI8XteaGIo6aPfUzcqGkHAjoKFohZCjRDqqUhNyIbg1x
 e6TaVPT+FierndR7QdKtte3QRGifhBLKKeKWX6zfNHsPDXP5GxyY42LWTVXSNFgJ
 XoLh6a7+GaEZOCaRxxKsenO1ot6AHSjnMjzr588CAwEAAaN1MHMwDwYDVR0TBAgw
-BgEB/wIBADALBgNVHQ8EBAMCAoQwEwYDVR0lBAwwCgYIKwYBBQUHAwQwHQYDVR0O
+BgEB/wIBADALBgNVHQ8EBAMCAYYwEwYDVR0lBAwwCgYIKwYBBQUHAwQwHQYDVR0O
 BBYEFEXqf3iWtpvlqUYcVC8NbU3QVTe5MB8GA1UdIwQYMBaAFAQrxeyo16wcMG7Z
-fPqsR2DT04r0MA0GCSqGSIb3DQEBCwUAA4IBgQAsuH3BBIxT2qR/yeyKqVQsfVIa
-2AmpzYd7AE8+017XgGoqvqA71r3gZXaf7/FhBzuIp2+PQTnyu+UarJLztIsnbEMD
-BXxRq7t6FHqERf7qQlEZBwhVpE7AcM8/9PyI+qLbHHG5x4ZRsFO7YoxsUjQna7SU
-qRhFkj3gwHOQGmbhV46fpQ5ioFqe1X5SIU5SyeezAhO25wn9iBHU7Z4J1v8MAukY
-wY+q75xncHa/JK8GQ9v8JtS4buCQNkAEPew0t+AN85rI0t6DHWjHy6kHy8wiACfo
-BSno+anWqtiqDyQpzRR8Tk9oXztjOlVhyHxG6r9j4VcUIku2UtJVuaZi3KDrLVwK
-L7xURZ0QNEsL9JZ8ojO54F2GLOdF3CW/lG54tQktAWmKzLXZs1jZkIPA3jnzd3G5
-pfp7YlhMJqkHTly2w1qjXgZ8WThh9WbSpWP0RE92lO7H2VFSREwr8o73W6XZpssT
-QRsJSRoUulDurvrfKsro5TNskcRX9ZNk9pBWlVo=
+fPqsR2DT04r0MA0GCSqGSIb3DQEBCwUAA4IBgQBUPzMNDTt8sb3wsLEIEsLbRBdK
+kyDknQv2k3ZhCJmvpctxlSoOPuJhTZi9pF1BCAq7Uy1hJLBWLKr4EYJbHeI3eMgd
+O68NTXBmne9AwMKVb3mm51IHt6/bF4dz90KWpsrQswVOMOUMUjGy5zkVGU4S7pHz
+86/5P/Hl4hlQUGTEHucsmt7SyLPL5bOfbNERg/m2Z/vtkteDwYqnjyrSbt69XCp2
+Y99B1iWzbseAuOmz95qiw0HNFumAVj1cgulmWK/C2Yeg5TrnuJ68YpRsYV0SzXZg
+qaDjgyZ7DbxeQ+r3lzvXfTQHJR04QQtW7L8p3rO+faZawMBqVNIP6cGSsImrChe4
+eVmN4njoBwiavsUjAWuuJ7UNhN0zK1akUBIidWixbxn+iGxriBKIyZ2qF3+2u+hL
+bby5x5Y/BgfOejCu/NvJgfzzpjgA8kjrsuySCyRELmXkxtIs4iBbIUcCj1cMasOX
+DmNK4GoJAUpfRLdAObRvhtMjFJXCkJduM0Zh3/g=
 -----END CERTIFICATE-----

configs/auth_verifier/kms_opa_rbac.toml

@@ -0,0 +1,91 @@
+# =============================================================================
+# Authentication Verifier — KMS OPA RBAC configuration
+# =============================================================================
+#
+# Configures the Authentication Verifier for use with the Cosmian KMS
+# OPA RBAC integration.  The five role names declared here match exactly
+# the roles evaluated by `test_data/opa/kms.rego`.
+#
+# Start from the `authentication/` directory:
+#
+#   ./target/debug/auth_verifier \
+#     ../test_data/configs/auth_verifier/kms_opa_rbac.toml
+#
+# Default super-admin credentials (realm "_"):
+#   username : admin
+#   password : change_me
+#
+# KMS realm seeded on first start:
+#   realm    : kms
+#   admin    : kms-admin / kms-admin-pass
+#
+# =============================================================================
+
+host_name = "127.0.0.1"
+host_port = 8443
+
+# ---------------------------------------------------------------------------
+# RBAC role names — must match the role names used in test_data/opa/kms.rego.
+# Exposed at GET /public/roles so the KMS admin UI can list available roles.
+# ---------------------------------------------------------------------------
+roles = [
+  "SuperAdmin",      # Unrestricted, cross-domain  (ANSI/INCITS 359 §4.2)
+  "DomainAdmin",     # Full access within own domain
+  "CryptoOfficer",   # Key lifecycle within own domain (FIPS 140-3 §7.4)
+  "Auditor",         # Read-only metadata within own domain (NIST SP 800-53 AU-9)
+  "User",            # Crypto-use only, no lifecycle (FIPS 140-3 §7.4)
+]
+
+# Admin UI — serve the pre-built SPA at /admin-ui.
+# Path is relative to the directory where auth_verifier is started (authentication/).
+admin_ui_path = "admin-ui/dist"
+
+# ---------------------------------------------------------------------------
+# Console logging
+# ---------------------------------------------------------------------------
+[log]
+level = "info"
+
+# ---------------------------------------------------------------------------
+# TLS — paths are relative to the authentication/ submodule root.
+# Replace with production certificates for non-development environments.
+# ---------------------------------------------------------------------------
+[tls_params]
+server_private_key = "server/src/tests/certificates/ec/auth.server.key.pem"
+server_certificate = "server/src/tests/certificates/ec/auth.server.cert.pem"
+server_ca_chain    = "server/src/tests/certificates/ec/auth.ca.pem"
+
+# ---------------------------------------------------------------------------
+# JWT signing — reuse the server TLS key for token signing (dev only).
+# In production, use a dedicated signing key.
+# ---------------------------------------------------------------------------
+[session_jwt_params]
+jwt_ec_private_key = "server/src/tests/certificates/ec/auth.server.key.pem"
+jwt_ec_public_key  = "server/src/tests/certificates/ec/auth.server.cert.pem"
+
+# ---------------------------------------------------------------------------
+# Database — persistent SQLite for the KMS RBAC test environment.
+# Switch to `sqlite::memory:` for fully ephemeral test runs.
+# ---------------------------------------------------------------------------
+[database_params]
+auto_init_schema = true
+backend          = "sqlite"
+connection_url   = "sqlite:///tmp/kms_opa_rbac_auth.db"
+
+# ---------------------------------------------------------------------------
+# Development seed — creates the `kms` realm and a realm-admin on first start.
+# All operations are idempotent; the seed is safe to leave enabled.
+# ---------------------------------------------------------------------------
+[dev_seed]
+realm_id       = "kms"
+admin_username = "kms-admin"
+admin_password = "kms-admin-pass"
+
+# ---------------------------------------------------------------------------
+# CORS — allow the KMS server origin on admin endpoints.
+# Adjust to match the actual KMS public URL in your deployment.
+# ---------------------------------------------------------------------------
+allowed_origins = [
+  "http://localhost:9998",
+  "http://127.0.0.1:9998",
+]