Crate secrets_engine_federation 

Federation (shape E) — the engine that deliberately issues nothing.

Under federation the provider is configured to trust the consumer’s own identity, so no credential is minted, brokered, stored or handed over. What a consumer needs from us is not a secret but an answer to “where do I exchange my own token, and what must that token say?”.

That makes this engine a directory rather than a vault, and it is the strongest outcome available: there is no root credential to compromise and no leased credential to leak. See docs/delegation/federation.md.

Structs

FederationConfig

The trust relationship an operator established at the provider. None of this is secret — it is the absence of a secret that makes federation worth the setup effort — but it lives behind sudo with every other engine’s config for consistency.

FederationEngine

RoleConfig

Which consumer may federate where. subject is the sub claim the provider’s trust policy pins, and pinning it is the whole game: a trust policy that checks only the issuer lets any workload from that issuer in.

Enums

ProviderTarget

Where a federated identity is being exchanged, and for what.