From 12834b6e8a96b98b7eb3558e4e652339209280b2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 11:00:04 +0100 Subject: [PATCH] NK-WP-0056-T04: svc-privacyidea design proposal (OpenBao custody, attended write-through) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- workplans/NK-WP-0056-bounded-executor-path.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 4b9adf0..3dec27c 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -200,6 +200,23 @@ restart, env-only verify and a second `admin` login all passed ([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered; `keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the privacyIDEA database, not a Secret key: needs its own design). + +**2026-10-31, `svc-privacyidea` design proposal (for founder decision):** privacyIDEA keeps the resolver `BINDPW` +encrypted in its own database, and only `pi-admin` with a fresh MFA code can change it (`realm_bootstrap.py`), so +neither ESO nor an unattended job can deliver it without a non-MFA admin credential (rejected: SI rules). +Proposed: **OpenBao custody with attended write-through**, following CCR-2026-0028 (`attended-host-key-delivery`): +1. bind-lane `svc-privacyidea setup`: the custody value must sign in to LLDAP as `svc-privacyidea` (LLDAP is the + authority for the current password; the working resolver proves privacyIDEA holds the same one), then KV + `directory-binds/svc-privacyidea` CAS=0, coding agents fenced. No Kubernetes role, no ESO, `runtime_access: false`. +2. `realm_bootstrap.py --switch-bind --from-openbao`: reads the KV value in memory under the attended + `platform-admin` session and writes only `BINDPW` with `pi-admin` + MFA; the existing preservation checks apply. +3. Rotation becomes: change the password in LLDAP, write the next KV version, run step 2, verify with an OTP login. + No custody decryption; the founder's MFA remains the gate. +4. CCR-2026-0055 needs a request type for attended delivery into a service; railiance-platform's + `credential-change.py` gains it, modelled on `attended-host-key-delivery`. +The done criterion of T04 then reads: three binds ESO-delivered, `svc-privacyidea` held in OpenBao with attended +write-through. Alternative: keep it in founder custody as a recorded exception until privacyIDEA can read the +resolver password from a file or environment. the env. ## Synthetic verification instead of a founder sign-in