coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: preserve realm configuration and remove shell credential evaluation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 22:47:24 +02:00
parent 96feef46ab
commit 30f0d27840
16 changed files with 700 additions and 430 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tools/security-bootstrap-console/README.md
View file

@ -158,11 +158,12 @@ recovery codes in this UI.
If the live privacyIDEA instance has lost the `coulomb` realm, LLDAP resolver,
or self-service policies, open **Usecases & Runbooks** and copy **Repair
privacyIDEA realm and self-service**. The action is attended: it prompts for
the `pi-admin` password and the LLDAP bind/admin password, writes them only to a
private temporary directory, runs
`sso-mfa/k8s/privacyidea/repair-realm-live.sh`, removes the temporary files on
exit, and then runs `sso-mfa/k8s/verify-t06.sh`. The UI does not store either
privacyIDEA realm and resolver**. The action is attended: it prompts for
the `pi-admin` password and, only when the resolver is absent, its LLDAP bind
password. `sso-mfa/k8s/privacyidea/repair-realm-live.sh` keeps them in memory,
repairs missing core configuration without replaying MFA policies, and runs the
same functional proof as `verify-t06.sh`. Missing onboarding policies require
their existing owner procedure; this action does not recreate them. The UI does not store either
password, and TOTP enrollment or re-enrollment remains a human step in
`https://pink-account.coulomb.social`.

4
tools/security-bootstrap-console/security_bootstrap_console.py
View file

@ -3158,8 +3158,8 @@ def runbook_command_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
return [
action(
"Repair privacyIDEA realm and self-service",
"Prompt for pi-admin and LLDAP bind passwords, recreate the coulomb realm, LLDAP resolver, self-enrollment policy, and passthrough bootstrap policy, then run T06 verification. The wrapper keeps passwords in a private temporary directory that is removed on exit.",
"Repair privacyIDEA realm and resolver",
"Prompt for pi-admin and, only for a missing resolver, its LLDAP bind password. Restore missing resolver/realm configuration and tuning while preserving credentials, existing realm bindings, defaults and owner-managed MFA policies; then run functional T06 verification. Passwords stay in memory. Conflicts require an owner-reviewed migration.",
privacyidea_realm_command,
),
action(