Dsh Ops Authn

Community

01men

dsh-ops-authn

管理机器身份、令牌与凭证的签发、撤销和轮换。

Overview

Publisher	01men
Repository	`ybkkasi`
Skill name	`dsh-ops-authn`
Stars	62
Forks	0
Bundled files	Instructions only
License	MIT
Links	Skill source Repository Homepage

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
Self-contained
Everything the model needs lives in the instructions — no extra files to sync.
Open source
Published by 01men on GitHub. Read the source before you install it.

Installation

Install the Dsh Ops Authn AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/01men/ybkkasi/tree/main/skills/dsh-ops-authn
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/01men/ybkkasi.git /tmp/ybkkasi
mkdir -p .claude/skills
cp -r /tmp/ybkkasi/skills/dsh-ops-authn .claude/skills/dsh-ops-authn

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Dsh Ops Authn in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Dsh Ops Authn on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Dsh Ops Authn is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Skill: dsh-ops-authn

何时使用

机器凭证签发与管理（Agent/应用/外部系统接入；权限范围调整、密钥轮换）、令牌签发与吊销、签名密钥轮换、on-behalf-of 链路验证、OIDC 客户端（应用 SSO 接入）管理与排障。

调用方式（工具优先）

平台已把运维能力注册为 dsh 工具，回答现状问题（查询/盘点/排障）必须直接调用工具获取真实数据，禁止凭记忆回答：

authn_token_issue / authn_token_revoke / authn_token_list / authn_credential_create / authn_credential_scopes（调整权限范围）/ authn_credential_rotate（轮换 clientSecret）（工具参数见各工具 schema；下文手册中的 dshctl ... 为「平台独立部署 + HTTP API 运维」场景的 CLI 备选，需 DSHCTL_TOKEN/DSHCTL_USER，在 dsh 会话内一般用不到。）

前置条件

需要 authn.* 权限组令牌；OIDC 客户端管理面需 authn.oidc.read（查看）/ authn.oidc.write（签发/轮换/禁用）。

操作手册

场景 1：为外部系统签发机器凭证

dshctl credential create --name="external:ci-system" --scope=mcp.invoke（--scope 支持逗号多值与 *）
clientSecret 仅返回一次——立即转存密钥管理系统
对方用法：POST /api/auth/client-credentials 换取访问令牌（2h 有效）

场景 1b：机器凭证治理（权限调整 / 密钥轮换）

列出凭证：dshctl credential list（principalId/clientId/scopes/状态/活跃令牌）
调整权限范围：dshctl credential scopes <principalId> --scopes=agent.read,usage.write （或控制台「认证与令牌 → 身份主体 → 编辑权限」，按权限目录分组勾选；调整后存量令牌全部联动吊销，机器侧需重新换牌）
密钥丢失/泄露：dshctl credential rotate <principalId> —— clientId 不变、旧 clientSecret 立即失效、新值仅此一次返回、存量令牌全部吊销。无需重新注册 Agent/重新签发凭证
启用/禁用主体：POST /api/authn/principals/:id/enable|disable（禁用联动吊销令牌）
scopes 合法性：必须全部命中权限目录（或恰为 ['*']），拼错（如 usage.wrtie）会被 400 拒绝

场景 2：疑似泄露应急

dshctl credential rotate <principalId> 一键轮换（旧 secret 失效 + 存量令牌全吊销）
需要定位令牌时：dshctl token list --principalId=<id>，dshctl token revoke <jti> --reason="疑似泄露" 逐个吊销
严重时禁用主体（控制台认证与令牌页）或轮换签名密钥（吊销全部令牌）

场景 3：验证 on-behalf-of 链

POST /api/agents//obo-token（用户令牌发起）→ 返回 act 链：用户 → Agent。审计日志的「令牌链」字段可还原完整链路。

场景 4：应用接入 SSO（OIDC 客户端）

应用 owner 在控制台「AI 应用 → 详情 → SSO 配置」签发客户端（或管理员在「认证与令牌 → OIDC 客户端」全局登记）
client_secret 仅展示一次；回调地址允许 https:// 任意主机，或 http:// 内网地址（localhost / 127.0.0.1 / 10.x / 172.16-31.x / 192.168.x，纯内网部署可 APP_SSO_ALLOW_HTTP=1 放开）；纯前端 SPA 选 public 类型（免 secret、强制 PKCE、无 refresh）
应用侧按 docs/app-sso-integration.md 接入（openid-client / oidc-client-ts，discovery 驱动一行式）
web/h5 形态应用上线门禁：未签发有效客户端时 requestOnline 直接拒绝（APP_SSO_ENFORCE 可调）

场景 5：OIDC 令牌/客户端排障

「回跳后报 invalid_client」→ secret 已轮换（旧值立即失效）或客户端被禁用（应用下架/归档联动）
「id_token 调 userinfo 401」→ 预期行为：userinfo 仅接受 access token（token_use 校验）
「refresh 换发 400」→ 检查：旧值重放（整链已吊销）、scope 扩大（只允许收窄）、账号冻结（实时校验）、public 客户端（本就不发 refresh）
「上线审批通过但执行失败留痕」→ 门禁点 2：审批挂单期间客户端被禁用，重新启用后再发起
JWKS 密钥轮换（控制台「认证与令牌」）：新 key 立即签名，旧 key 24h 宽限验签，在途令牌不掉线

护栏

clientSecret 任何情况下不得明文落库/入日志
轮换签名密钥会使全部存量令牌失效，需提前公告
OIDC 私钥存 data 目录（oidc-keys.json，数组化多 key），生产建议迁 KMS

Frequently asked questions

What does the Dsh Ops Authn AI skill do?

管理机器身份、令牌与凭证的签发、撤销和轮换。

Why use Dsh Ops Authn on TypingMind?

Because you install it once and use it with any model. Dsh Ops Authn is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Dsh Ops Authn in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/01men/ybkkasi/tree/main/skills/dsh-ops-authn. TypingMind reads its SKILL.md and installs it as a skill you can enable per chat.

Which AI models can use Dsh Ops Authn?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Dsh Ops Authn?

As many as you like. As long as a model supports skills, you can use Dsh Ops Authn with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Dsh Ops Authn AI skill free?

Yes. It is published on GitHub by 01men under the MIT license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Tensorrt Llm

NousResearch

OrganizationPopular

High-throughput LLM inference on NVIDIA GPUs.

Internal Comms

A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal…

Claude Opus 4 5 Migration

anthropics

OrganizationPopular

Migrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5. Use when the user wants to update their codebase, prompts, or API calls to use Opus 4.5. Handles model string…

Deploy Release Test

Validate a commit-specific Next.js preview package and manually trigger the entire Next.js deployment test suite through the test_e2e_deploy_release.yml GitHub Actions workflow. Use only when asked to…

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Skill: dsh-ops-authn

何时使用

调用方式（工具优先）

前置条件

操作手册

场景 1：为外部系统签发机器凭证

场景 1b：机器凭证治理（权限调整 / 密钥轮换）

场景 2：疑似泄露应急

场景 3：验证 on-behalf-of 链

场景 4：应用接入 SSO（OIDC 客户端）

场景 5：OIDC 令牌/客户端排障

护栏

Frequently asked questions

Related AI Skills

Set up your own AI workspace now