97 lines
4.2 KiB
YAML
97 lines
4.2 KiB
YAML
|
apiVersion: netkingdom.io/playbook-capability/v0.1
|
||
|
|
kind: PlaybookCapabilityDeclaration
|
||
|
|
metadata:
|
||
|
|
id: key-cape.privacyidea-token-authority
|
||
|
|
name: KeyCape privacyIDEA token-authority integration
|
||
|
|
owner: key-cape
|
||
|
|
repo: key-cape
|
||
|
|
domain: infotech
|
||
|
|
contract_version: "0.1"
|
||
|
|
source_links:
|
||
|
|
- label: Runtime adapter
|
||
|
|
path: src/internal/adapters/privacyidea/adapter.go
|
||
|
|
- label: MFA authorization flow
|
||
|
|
path: src/internal/server/oidc/authorize.go
|
||
|
|
spec:
|
||
|
|
playbook:
|
||
|
|
path: src/internal/adapters/privacyidea/adapter.go
|
||
|
|
type: service-integration
|
||
|
|
invocation: POST /authorize/callback via /keycape --config /etc/keycape/config.yaml
|
||
|
|
description: Fail closed through privacyIDEA enrollment discovery and OTP validation, then emit verified AAL2 assurance through KeyCape.
|
||
|
|
capabilities:
|
||
|
|
- id: c2b.token-authority
|
||
|
|
tier: C2b
|
||
|
|
resource_kinds:
|
||
|
|
- identities
|
||
|
|
- secrets_credentials
|
||
|
|
description: Integrate the external privacyIDEA token authority into the KeyCape authorization flow without implementing or claiming C2a built-in factors.
|
||
|
|
parameters:
|
||
|
|
- name: privacyidea_base_url
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: http://privacyidea.sso.svc.cluster.local:80
|
||
|
|
constraints:
|
||
|
|
pattern: ^https?://[^\n\r]+$
|
||
|
|
sensitivity: security_sensitive
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Cluster-local privacyIDEA API endpoint selected by the deployment owner.
|
||
|
|
- name: privacyidea_admin_token_ref
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: kubernetes://sso/keycape-config#config.yaml
|
||
|
|
sensitivity: secret_reference
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Reference to the mounted KeyCape configuration carrying privacyIDEA API authentication; never a token value.
|
||
|
|
- name: realm
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: coulomb
|
||
|
|
constraints:
|
||
|
|
pattern: ^[a-z0-9][a-z0-9_-]{0,62}$
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Exact privacyIDEA realm used for token lookup and validation.
|
||
|
|
- name: require_for_all
|
||
|
|
type: boolean
|
||
|
|
required: false
|
||
|
|
default: true
|
||
|
|
sensitivity: security_sensitive
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Fail-closed bootstrap posture requiring MFA for upstream users while enrollment remains independently verified.
|
||
|
|
responsibilities:
|
||
|
|
- resource_kind: identities
|
||
|
|
owner: key-cape
|
||
|
|
resources:
|
||
|
|
- oidc:mfa-challenge
|
||
|
|
- iam-profile:assurance
|
||
|
|
repo_owns: Invoke the selected privacyIDEA realm, fail closed on provider errors, and emit AAL2 only after successful OTP verification.
|
||
|
|
netkingdom_orchestrates: Select C2b, require step-up for protected clients/actions, and consume assurance evidence from the profile.
|
||
|
|
- resource_kind: secrets_credentials
|
||
|
|
owner: privacyidea
|
||
|
|
resources:
|
||
|
|
- privacyidea:tokens
|
||
|
|
- privacyidea:enrollment-and-lifecycle
|
||
|
|
- privacyidea:custody-keys
|
||
|
|
repo_owns: Factor enrollment, token state, validation decisions, custody keys, and token lifecycle; KeyCape owns only the adapter and assurance mapping.
|
||
|
|
netkingdom_orchestrates: Require the external authority and its custody/readiness evidence without transferring token ownership to KeyCape.
|
||
|
|
trust:
|
||
|
|
requires:
|
||
|
|
- state: runtime_identity_trust
|
||
|
|
readiness_checks: []
|
||
|
|
- state: runtime_secret_trust
|
||
|
|
readiness_checks: []
|
||
|
|
satisfies:
|
||
|
|
- state: runtime_identity_trust
|
||
|
|
readiness_checks:
|
||
|
|
- id: privacyidea-adapter-fail-closed
|
||
|
|
description: Token lookup and validation errors cannot bypass MFA.
|
||
|
|
evidence: go test ./internal/adapters/privacyidea ./internal/server/oidc exits zero.
|
||
|
|
- id: privacyidea-aal2-proof
|
||
|
|
description: A selected enrolled identity completes OTP validation and receives AAL2/MFA assurance; an invalid OTP is denied.
|
||
|
|
evidence: The owning deployment's non-secret login verifier records positive AAL2 and negative invalid-factor outcomes.
|
||
|
|
catalog:
|
||
|
|
publish: capabilities/playbooks/key-cape.privacyidea-token-authority.yaml
|
||
|
|
maturity: implemented-integration
|
||
|
|
consumers:
|
||
|
|
- netkingdom-security-scenario-composer
|