This documentation describes AuthBox v0.3.0-133-g71cb5564.

2. Enroll your first person

You have a box running from step 1. Nothing in it will talk to you until you hold a client certificate, so that is what this step gets you — for a person of your own, beyond the four the evaluation image minted.

One thing is true of every path below: your private key is generated on your own machine and never leaves it. AuthBox does not generate your key, does not receive it and does not store it. What you send is a certificate signing request — a public key and the name you are asking to be issued under — never the private half.

First, an invitation

An invitation is a one-time token. It either grants a certificate immediately or names exactly what group membership the holder receives on approval. Create one from the console's Invitations page as eval-admin, or from the command line of a host holding an administrator's credential:

$ authboxctl invite create firstperson -role admin

What comes back is a token and a link; the link is what you hand to the person. With the released image there is already one: the bootstrap administrator invitation the log printed.

Then, the enrollment

The shortest path is the command-line client, which generates the key, fetches the profile so it can tell you locally whether a choice would be refused, builds the request and submits it:

$ authboxclient enroll -server https://<the box>:8443 -ca ca.pem \
    -subject "CN=firstperson,O=Evaluation,C=US" -invitation YOUR-TOKEN

ca.pem is the box's own authority, docker cp writer:/data/pki/ca.pem .. With no client on your machine, docker logs writer prints the same claim as three lines that run authboxclient from the authboxus/authbox-tools image beside the box, and those are the lines to copy.

If the invitation issues immediately, the certificate comes back in the same breath. Otherwise you get status pending and a request identifier, and an administrator approves it from the console's Enrollments page.

You do not need that client. Opening the invitation link in a browser reaches the public enrollment page with the token already filled in, and that page walks the same steps with tools you already have. The console never asks anybody to paste a private key, and could not safely process one if they tried.

What success looks like

$ authboxclient credentials list
$ authboxclient status

The first lists what you hold; the second names the credential that is currently active. From here the certificate is the login: there is no password to set and no session to expire.

Now open the console with it. You are seeing exactly what this person is authorized to see — no more, and the parts they may not see are absent rather than grayed out.

Next: Protect a service