coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: preserve realm configuration and remove shell credential evaluation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 22:47:24 +02:00
parent 96feef46ab
commit 30f0d27840
16 changed files with 700 additions and 430 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tools/security-bootstrap-console/README.md
View file

@ -158,11 +158,12 @@ recovery codes in this UI.
If the live privacyIDEA instance has lost the `coulomb` realm, LLDAP resolver,
or self-service policies, open **Usecases & Runbooks** and copy **Repair
privacyIDEA realm and self-service**. The action is attended: it prompts for
the `pi-admin` password and the LLDAP bind/admin password, writes them only to a
private temporary directory, runs
`sso-mfa/k8s/privacyidea/repair-realm-live.sh`, removes the temporary files on
exit, and then runs `sso-mfa/k8s/verify-t06.sh`. The UI does not store either
privacyIDEA realm and resolver**. The action is attended: it prompts for
the `pi-admin` password and, only when the resolver is absent, its LLDAP bind
password. `sso-mfa/k8s/privacyidea/repair-realm-live.sh` keeps them in memory,
repairs missing core configuration without replaying MFA policies, and runs the
same functional proof as `verify-t06.sh`. Missing onboarding policies require
their existing owner procedure; this action does not recreate them. The UI does not store either
password, and TOTP enrollment or re-enrollment remains a human step in
`https://pink-account.coulomb.social`.