tegwick
85f5deaf4a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
60 lines
2 KiB
Markdown
60 lines
2 KiB
Markdown
---
|
|
id: KEY-WP-0035
|
|
type: workplan
|
|
title: "Opt-in MFA for demo-company login"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-09-13"
|
|
updated: "2026-09-13"
|
|
state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74"
|
|
---
|
|
|
|
Requested behavior: password-only login before OTP activation; require OTP after
|
|
activation. Do not lower assurance of unrelated applications.
|
|
|
|
## Implement enrollment-dependent browser policy
|
|
|
|
```task
|
|
id: KEY-WP-0035-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f"
|
|
```
|
|
|
|
Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on
|
|
provider lookup errors and malformed/incomplete responses. Preserve the setting
|
|
in config/runtime/canonical model and flag manual migration requirements.
|
|
Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See docs/optional-mfa.md.
|
|
|
|
## Restore authoritative factor lookup and enable the reviewed client
|
|
|
|
```task
|
|
id: KEY-WP-0035-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"
|
|
```
|
|
|
|
Live factor-read credentials return HTTP 401. The owner route
|
|
net-kingdom-privacyidea-admin-token is non-resolvable pending railiance-platform's
|
|
approved custody/renewal contract (NK-WP-0033). Native credential handoff required;
|
|
no secrets in work records. Do not enable the policy before lookup is verified.
|
|
Prepare exact byte-preserving client migration after the provider contract is
|
|
available; deploy digest-pinned source and run no-factor/enrolled/error checks.
|
|
|
|
## Verify optional enrollment and account management access
|
|
|
|
```task
|
|
id: KEY-WP-0035-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"
|
|
```
|
|
|
|
Verify provider self-service login, possession-confirmed activation, cancellation
|
|
and removal/recovery. Resolve shared portal assurance scope before surfacing the
|
|
verified OTP setup link. Actual user login acceptance remains open under
|
|
KEY-WP-0034 and VERGABE-WP-0019; this work does not finish either workplan.
|