coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require confirmed enrollment and genuine OTP evidence for MFA
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 16:37:08 +02:00
parent 3a36f1a507
commit 122a0d1369
7 changed files with 165 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/optional-mfa.md
View file

@ -18,21 +18,32 @@ administrative tokenlist permission: a user-role token only lists its own factor
regardless of the requested username. Never replace it with a self-service JWT.
See the [provider API](https://privacyidea.readthedocs.io/en/stable/modules/api/token.html).
## Deployment gate — not yet enabled
## Deployment gate — optional client policy not yet enabled
Live inspection on 2026-09-13 found `requireForAll: true`; both the demo-company
and account-portal registrations inherit it. Configured token-list credentials
return HTTP 401, so enabling this setting now would replace the OTP prompt with
a lookup failure. No live policy has been changed.
Factor-read custody, automatic renewal and mounted-file delivery were restored
on 2026-09-13 through RPF-WP-0040 / CCR-2026-0023. KeyCape uses adminTokenFile;
per-user provider lookup and mounted renewal passed. Historical resolver incident
lanes remain separate; there is no missing-owner gate for this service lane.
Credential owner: railiance-platform / OpenBao, route
`net-kingdom-privacyidea-admin-token`. Its concrete delivery and renewal contract
is unpublished (`resolvable: false`). Obtain an owner-approved realm-scoped
factor-read credential through the native custody path, with renewal and
revocation ownership. Do not put credentials in chat, arguments, work records,
or config examples. The older refresh-pi-token-live.sh needs review before use.
The live provider has `mfa-passthru-phase1`, so a positive validation value alone
can mean directory-password success. KeyCape accepts AAL2 only when a successful
response identifies a TOTP/HOTP token by serial and type. Static-password tokens,
missing factor evidence and unsuccessful status cannot grant AAL2.
privacyIDEA's `active` flag does not imply completed enrollment. Its verification
policy sets `rollout_state=verify` while leaving `active` unchanged. KeyCape
therefore recognizes `enrolled` and the provider's legacy empty state as enrolled;
`verify`, `clientwait` and `pending` remain incomplete. Missing/unknown/broken
states and incomplete result pages fail closed. Existing verified factors still
require OTP while an additional token is pending. Mandatory and explicit AAL2
policies remain mandatory throughout onboarding.
Current provider self-service policy allows TOTP enrollment/deletion/disabling,
but possession confirmation is not yet required. Review and exercise that
transition plus authenticated recovery before enabling the optional client.
Remaining live acceptance:
After credential delivery:
1. Verify the deployed provider accepts the raw JWT and returns authoritative
count/tokens results for controlled accounts with and without a factor.