57 lines
1.8 KiB
Markdown
57 lines
1.8 KiB
Markdown
|
---
|
||
|
|
id: KEY-WP-0035
|
||
|
|
type: workplan
|
||
|
|
title: "Opt-in MFA for demo-company login"
|
||
|
|
domain: infotech
|
||
|
|
repo: key-cape
|
||
|
|
status: active
|
||
|
|
owner: codex
|
||
|
|
topic_slug: infotech
|
||
|
|
created: "2026-09-13"
|
||
|
|
updated: "2026-09-13"
|
||
|
|
---
|
||
|
|
|
||
|
|
Requested behavior: password-only login before OTP activation; require OTP after
|
||
|
|
activation. Do not lower assurance of unrelated applications.
|
||
|
|
|
||
|
|
## Implement enrollment-dependent browser policy
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0035-T01
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on
|
||
|
|
provider lookup errors and malformed/incomplete responses. Preserve the setting
|
||
|
|
in config/runtime/canonical model and flag manual migration requirements.
|
||
|
|
Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See docs/optional-mfa.md.
|
||
|
|
|
||
|
|
## Restore authoritative factor lookup and enable the reviewed client
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0035-T02
|
||
|
|
status: wait
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Live factor-read credentials return HTTP 401. The owner route
|
||
|
|
net-kingdom-privacyidea-admin-token is non-resolvable pending railiance-platform's
|
||
|
|
approved custody/renewal contract (NK-WP-0033). Native credential handoff required;
|
||
|
|
no secrets in work records. Do not enable the policy before lookup is verified.
|
||
|
|
Prepare exact byte-preserving client migration after the provider contract is
|
||
|
|
available; deploy digest-pinned source and run no-factor/enrolled/error checks.
|
||
|
|
|
||
|
|
## Verify optional enrollment and account management access
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0035-T03
|
||
|
|
status: wait
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Verify provider self-service login, possession-confirmed activation, cancellation
|
||
|
|
and removal/recovery. Resolve shared portal assurance scope before surfacing the
|
||
|
|
verified OTP setup link. Actual user login acceptance remains open under
|
||
|
|
KEY-WP-0034 and VERGABE-WP-0019; this work does not finish either workplan.
|