coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T04: svc-privacyidea design proposal (OpenBao custody, attended write-through)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
tegwick 2026-10-31 11:00:04 +01:00
parent a65673985c
commit 12834b6e8a
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -200,6 +200,23 @@ restart, env-only verify and a second `admin` login all passed
([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered;
`keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the
privacyIDEA database, not a Secret key: needs its own design).
**2026-10-31, `svc-privacyidea` design proposal (for founder decision):** privacyIDEA keeps the resolver `BINDPW`
encrypted in its own database, and only `pi-admin` with a fresh MFA code can change it (`realm_bootstrap.py`), so
neither ESO nor an unattended job can deliver it without a non-MFA admin credential (rejected: SI rules).
Proposed: **OpenBao custody with attended write-through**, following CCR-2026-0028 (`attended-host-key-delivery`):
1. bind-lane `svc-privacyidea setup`: the custody value must sign in to LLDAP as `svc-privacyidea` (LLDAP is the
authority for the current password; the working resolver proves privacyIDEA holds the same one), then KV
`directory-binds/svc-privacyidea` CAS=0, coding agents fenced. No Kubernetes role, no ESO, `runtime_access: false`.
2. `realm_bootstrap.py --switch-bind --from-openbao`: reads the KV value in memory under the attended
`platform-admin` session and writes only `BINDPW` with `pi-admin` + MFA; the existing preservation checks apply.
3. Rotation becomes: change the password in LLDAP, write the next KV version, run step 2, verify with an OTP login.
No custody decryption; the founder's MFA remains the gate.
4. CCR-2026-0055 needs a request type for attended delivery into a service; railiance-platform's
`credential-change.py` gains it, modelled on `attended-host-key-delivery`.
The done criterion of T04 then reads: three binds ESO-delivered, `svc-privacyidea` held in OpenBao with attended
write-through. Alternative: keep it in founder custody as a recorded exception until privacyIDEA can read the
resolver password from a file or environment.
the env.
## Synthetic verification instead of a founder sign-in