← All practicals

Give a workload an identity — no stored secret

Exchange a simulated platform credential for a short-lived SPIFFE JWT-SVID — RFC 8693 token exchange, keyless.

1. 1

   On the Workloads lab, register a binding: name it, pick a spiffe://lab.integrauth.com/… ID, and name the (simulated) platform issuer + subject you trust.

   This is the pre-registered trust relationship — "I trust issuer X's subject Y; give it SPIFFE ID Z" — the same shape a real platform team configures once for a CI pipeline or a k8s workload.

2. 2

   Mint a simulated external credential for that same issuer + subject.

   This stands in for the OIDC token a real CI job or cloud VM already holds from its OWN platform — no static API key was ever shipped to it.

3. 3

   Exchange it for a JWT-SVID and read the decoded claims.

   RFC 8693 token exchange: the Lab verifies the credential, matches its (issuer, subject) against your binding, and mints a short-lived JWT whose sub IS the SPIFFE ID — a real, verifiable identity for a machine, with nothing to leak.