tegwick
7b4b75089c
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
97 lines
5.8 KiB
Markdown
97 lines
5.8 KiB
Markdown
# Native password-reset bind prerequisite
|
|
|
|
WP-0015-T04 remains open. An isolated native Authelia/LLDAP test identifies a
|
|
directory permission prerequisite before the full UC-009 browser journey can be
|
|
accepted. It does not change the existing personal reset acceptance, prove the
|
|
currently installed bind's privileges or authorize any live permission change.
|
|
|
|
The inspected NetKingdom source assigns `svc-authelia` to
|
|
`lldap_strict_readonly` in `sso-mfa/k8s/lldap/bind-split.py`. The Authelia
|
|
ConfigMap binds as that account. The owner rehearsal checks first-factor login,
|
|
which succeeds under this role. Password reset needs a separate write operation;
|
|
first-factor success cannot establish recovery readiness.
|
|
|
|
`scripts/rehearse-native-password-reset.py` now runs the actual pinned Authelia
|
|
4.39.28 and LLDAP 0.6.2 binaries against a fresh synthetic directory. It tests
|
|
the read-only role and then the password-manager role on a dedicated fixture
|
|
account, with a fresh Authelia store for each case. No owner checkout is changed.
|
|
|
|
| Check | Strict read-only bind | Password-manager bind |
|
|
| --- | --- | --- |
|
|
| Human first-factor login | Succeeds | Succeeds |
|
|
| Native reset notification generated | Yes | Yes |
|
|
| Valid reset-link identity verification | Succeeds | Succeeds |
|
|
| Password change | Refused; HTTP 200 with `status: KO` | Succeeds; HTTP 200 with empty body |
|
|
| Old directory password afterward | Still accepted | Refused |
|
|
| Replacement directory password afterward | Refused | Accepted |
|
|
| Consumed reset-link replay | Refused | Refused |
|
|
| Reset without verified challenge | Refused | Refused |
|
|
| Interactive Authelia login as service bind | Refused by the service-account filter | Refused by the same filter |
|
|
| Directory group creation using the service identity | Refused | Refused |
|
|
|
|
The test checks native response status **and actual directory authentication**.
|
|
An HTTP 200 alone would misclassify the read-only failure. Usable handles,
|
|
cookies, passwords and notification text remain private and are absent from
|
|
the public receipt. The password-manager result concerns an ordinary synthetic
|
|
human; it does not establish privileged-account recovery or every directory right.
|
|
|
|
[Authelia's LLDAP integration documentation](https://www.authelia.com/integration/ldap/lldap/)
|
|
requires the bind to support password changes when reset is desired. The pinned
|
|
[native reset handler](https://raw.githubusercontent.com/authelia/authelia/v4.39.28/internal/handlers/handler_reset_password.go)
|
|
performs that update after identity verification. These native test results
|
|
confirm the boundary without relying on a protocol double.
|
|
|
|
## Isolation and repetition
|
|
|
|
```sh
|
|
python3 scripts/rehearse-native-password-reset.py \
|
|
--output /tmp/fresh-native-reset-receipt.json
|
|
```
|
|
|
|
The command requires the three retained image digests named in its source; it
|
|
never pulls. The product image supplies only the Python standard-library probe;
|
|
its application entrypoint and Django are not started. The test uses the default
|
|
local Unix Docker socket, a unique network-none
|
|
directory container, and Authelia/probes sharing only that container's loopback
|
|
namespace. Backend containers are inspected before fixture import: read-only
|
|
root, nonroot UID, dropped capabilities, no new privileges, bounded CPU/memory,
|
|
no published ports, no devices and exclusively private tmpfs mounts. The probe
|
|
also checks that only loopback exists and no external IPv4 routes exist.
|
|
|
|
Only generated synthetic credentials are delivered through pipes into tmpfs.
|
|
There is no live configuration, production data, key custody, SMTP provider,
|
|
external DNS reachability, host mount, persistent volume or network bridge. Native notifications
|
|
use Authelia's private filesystem notifier, not an SMTP/inbox delivery claim.
|
|
The API probe emulates the local proxy's forwarded headers and secure-cookie
|
|
transport; it is not browser or TLS verification. All backend/probe containers
|
|
are removed and their absence checked, including on failures. Failed fixture
|
|
startup leaves only a private redacted diagnostic on the workstation.
|
|
|
|
Retain the JSON receipt with its adjacent `.sources.txt` manifest. The JSON binds
|
|
that manifest's hash; the manifest contains only canonical filename/content
|
|
digests. Existing outputs refuse. Assertions must be enabled. Negative CLI checks
|
|
prove that optimized assertions and either existing output refuse without
|
|
overwriting evidence. Ruff and the native rehearsal pass. The full `make check`
|
|
gate was also rerun:396 passed, zero failures/errors/skips, including required browsers.
|
|
|
|
## Required owner return and remaining journey
|
|
|
|
Keep the bind's read and password-reset responsibilities explicit. NetKingdom
|
|
must review a supported narrow reset authority or another supported recovery
|
|
path under its existing NK-WP-0054-T05 bind-split work, including any privileged
|
|
account limits. Do not silently promote the production bind to directory admin
|
|
or infer that the synthetic password-manager grant is approved for production.
|
|
The source-role mismatch is retained on the existing WP-0015-T04; it is not a
|
|
new credential request or a duplicated provider implementation task.
|
|
|
|
After that owner return, complete isolated native browser reset/expiry/replay,
|
|
local mail-sink delivery, KeyCape/client/tenant isolation and real app login.
|
|
The current test proves the native reset prerequisite only. It proves no OIDC
|
|
issuance, MFA ceremony, TLS/browser flow, application session or productive
|
|
runtime/permission acceptance. UC-009 remains `established: false`.
|
|
|
|
October31 follow-through: the separate native browser gate now exercises SMTP,
|
|
expiry/replay, KeyCape, user-engine HTTP and the actual app callback using an
|
|
explicit synthetic password-manager bind. See native-recovery-browser-review-2026-10-31.md.
|
|
That new proof does not grant production reset authority or rewrite this API-only
|
|
receipt's scope.
|