coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Validate cadence contract and require functional MFA verification
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd
This commit is contained in:
tegwick 2026-09-05 01:28:05 +02:00
parent d4d61b722e
commit 4e07d60ff1
34 changed files with 1640 additions and 364 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/architecture/net-kingdom_v0.1.md
View file

@ -114,6 +114,7 @@ N/A for this stub.
| `netkingdom-tenancy-posture` | proposed | Graduated multi-tenancy posture. |
| `netkingdom-iam-profile-v0.3` | accepted | Current provider-neutral identity contract. |
| `netkingdom-posture-feedback-v0.1` | proposed | Governed posture feedback. |
| `netkingdom-emission-cadence-security-profile-v0.1` | proposed | NetKingdom evidence-cadence obligations; owner-instance migration pending. |
| `netkingdom-security-layer-model-v0.7` | accepted | Current security-layer interaction model. |
| `netkingdom-security-scenario-composition-v0.1` | proposed | Security scenario composition. |
| `netkingdom-security-zones-v0.1` | proposed | Security-zone vocabulary and boundaries. |

60
docs/attended-procedure-inventory.md Normal file
View file

@ -0,0 +1,60 @@
# Attended procedure inventory — 2026-09-05
Reviewed all 32 shell scripts under `sso-mfa/k8s/` for NK-WP-0034-T03.
Exercise status: unknown unless the row states otherwise. Existing deployment
or task completion is not treated as proof that a particular script revision
completed successfully with an identified operator. Unknown does not mean never run.
Runbook matching below requires an explicit script reference in the component
runbook or a dedicated procedure. Missing runbooks are listed separately.
| Script (under `sso-mfa/k8s/`) | Runbook | Exercise status |
| --- | --- | --- |
| `authelia/create-secrets.sh` | [README.md](../sso-mfa/k8s/authelia/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `keycape/configure-openbao-oidc.sh` | [README.md](../sso-mfa/k8s/keycape/README.md) | unknown |
| `keycape/create-pi-token.sh` | [README.md](../sso-mfa/k8s/keycape/README.md) | unknown |
| `keycape/create-secrets.sh` | [README.md](../sso-mfa/k8s/keycape/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `keycape/patch-openbao-client.sh` | [README.md](../sso-mfa/k8s/keycape/README.md) | unknown |
| `keycape/refresh-pi-token-live.sh` | [README.md](../sso-mfa/k8s/keycape/README.md) | unknown |
| `keycape/register-coulomb-social.sh` | None found | unknown |
| `keycape/verify-openbao-client.sh` | [README.md](../sso-mfa/k8s/keycape/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `lldap/bootstrap-users.sh` | [README.md](../sso-mfa/k8s/lldap/README.md), [OPERATOR-GROUPS.md](../sso-mfa/k8s/lldap/OPERATOR-GROUPS.md) | unknown |
| `lldap/break-glass.sh` | [platform-root-custody.md](../docs/platform-root-custody.md) | unknown |
| `lldap/create-secrets.sh` | [README.md](../sso-mfa/k8s/lldap/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `lldap/create-user.sh` | [OPERATOR-GROUPS.md](../sso-mfa/k8s/lldap/OPERATOR-GROUPS.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `lldap/dry-run-nonroot-user.sh` | [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `lldap/manage-group-members.sh` | [OPERATOR-GROUPS.md](../sso-mfa/k8s/lldap/OPERATOR-GROUPS.md) | unknown |
| `postgresql/create-secrets.sh` | [README.md](../sso-mfa/k8s/postgresql/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `privacyidea/bootstrap-admin.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md) | unknown |
| `privacyidea/bootstrap-realm.sh` | [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md) | unknown |
| `privacyidea/check-user-mfa-state.sh` | [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `privacyidea/create-secrets.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
| `privacyidea/enckey-bootstrap.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md) | unknown |
| `privacyidea/reconcile-lldap-resolver-live.sh` | [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md) | attempted by Bernd Worsch 2026-08-27; no completed PASS receipt |
| `privacyidea/repair-realm-live.sh` | [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md), [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md), [verify-t06.md](../docs/verify-t06.md) | unknown |
| `privacyidea/update-lldap-resolver-live.sh` | None found | unknown |
| `user-engine/verify-operability.sh` | None found | unknown |
| `verify-identity-cutover-dependencies.sh` | None found | unknown |
| `verify-t02.sh` | [README.md](../sso-mfa/k8s/README.md) | unknown |
| `verify-t03.sh` | [DR-RUNBOOK.md](../sso-mfa/k8s/backup/DR-RUNBOOK.md) | unknown |
| `verify-t04.sh` | [DR-RUNBOOK.md](../sso-mfa/k8s/backup/DR-RUNBOOK.md) | unknown |
| `verify-t05.sh` | [DR-RUNBOOK.md](../sso-mfa/k8s/backup/DR-RUNBOOK.md) | unknown |
| `verify-t06.sh` | [verify-t06.md](../docs/verify-t06.md) | unexercised on provider; HTTP simulation passed |
| `verify-t07.sh` | [DR-RUNBOOK.md](../sso-mfa/k8s/backup/DR-RUNBOOK.md) | unknown |
| `verify-t08.sh` | [DR-RUNBOOK.md](../sso-mfa/k8s/backup/DR-RUNBOOK.md) | unknown |
## Scripts without a matching runbook
- `sso-mfa/k8s/keycape/register-coulomb-social.sh` — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
- `sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh` — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
- `sso-mfa/k8s/user-engine/verify-operability.sh` — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
- `sso-mfa/k8s/verify-identity-cutover-dependencies.sh` — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
## Exercise evidence correction
The resolver reconciliation runbook previously called an attempted run
“exercised” despite the incident explicitly recording no green receipt. Its
header now says unexercised to successful completion. Existing incident
authority/window requirements still apply; this documentation review does not
authorize that attended cutover. The changed helper must be included in the
revision recorded by the operator.

4
docs/keycape-exposure-resolver-reconciliation.md
View file

@ -5,7 +5,7 @@ Workplan: `NK-WP-0033`
NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (repaired 2026-08-27 in `4a38511`; the previously pinned revision could not complete a run — see NK-WP-0033 T05)
Platform recovery contract: railiance-platform `453fed3`
Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`
Exercise status: exercised 2026-08-27 by Bernd Worsch — first run ever; four defects found and fixed (`4a38511`). See `attended-procedure-standard.md`.
Exercise status: unexercised to successful completion — attempted 2026-08-27 by Bernd Worsch; four defects found and fixed (`4a38511`), no green receipt. The 2026-09-05 shared transport refactor also awaits an attended run. See `attended-procedure-standard.md`.
This is the remaining attended provider-admin operation after the owner-reported
four-class cutover. It updates only privacyIDEA resolver `lldap-coulomb` so the
@ -20,7 +20,7 @@ State Hub, Git, chat, command arguments, or ordinary logs.
The operator must record a private approval receipt containing, at minimum:
- incident `KEYCAPE-EXPOSURE-20260823-01`;
- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and platform contract `453fed3`;
- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and its adjacent `pi_api.py` and platform contract `453fed3`;
- the owner receipt `45b236c8-052f-43d3-a472-44f8e9694da2`;
- the exact start/end window, attended driver, and independent abort operator;
- confirmation that the replacement LLDAP credential is the provider-approved

2
docs/platform-root-custody.md
View file

@ -1,5 +1,7 @@
# Platform Root Custody
Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See [procedure inventory](attended-procedure-inventory.md).
Status: active bootstrap policy
Date: 2026-05-24

2
docs/smooth-bootstrap-guide.md
View file

@ -1,5 +1,7 @@
# NET-WP-0018 Smooth Bootstrap Guide
Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See [procedure inventory](attended-procedure-inventory.md).
**Status:** draft (initial consolidation for T05)
**Date:** 2026-06-03
**Purpose:** The single operator guide for a smooth, repeatable NetKingdom security bootstrap. An operator knows what to do, in what order, and what (non-secret) evidence proves each step complete. Covers the full sequence from the T05 spec + inputs from T02 runtime architecture, T03 retrospective + gap matrix, existing UX contracts (operator-journey, user-lifecycle), console lifecycle-guide (incl. 0019 T06-adjacent polish), evidence templates/validators, and make targets.

20
docs/verification-audit-2026-09-05.md Normal file
View file

@ -0,0 +1,20 @@
# SSO/MFA verification audit — 2026-09-05
NK-WP-0034-T02. Read-only review of `sso-mfa/k8s/verify-t02.sh` through
`verify-t08.sh`; no live target was contacted. T06 is the only verifier rewritten
in this workplan. The remaining findings are candidates for follow-up work.
| Script | Intended property | Actual assertion | Verdict |
| --- | --- | --- | --- |
| `verify-t02.sh` | Working namespaces, isolation, certificate issuance and storage | Named namespaces/policies/issuers exist; selected Ready conditions; optional certificate/storage tests can skip. Label and default StorageClass checks inspect command exit rather than nonempty values. | Insufficient: missing values can pass, network isolation never exercised, storage/certificates can remain unproven. |
| `verify-t03.sh` | PostgreSQL usable by privacyIDEA with required database and role | Cluster Ready, running primary, catalog rows for database/role, Secrets and optional scheduled backup resource | Partial: catalog/readiness checks are real but no application credential connection, write/read transaction or restore proof. |
| `verify-t04.sh` | Usable privacyIDEA deployment and bootstrap | Running pod, resource names/ports, certificates/PVCs, key files and admin rows; absent keys/admins can be warnings | Insufficient: no authenticated operation or MFA; warning-only gaps return 0. |
| `verify-t05.sh` | Integrated LLDAP–Authelia–KeyCape SSO | Readiness, resources and Secret presence, health responses and discovery content | Partial: service availability is checked; LDAP authentication, code exchange, claim correctness and login are not. Warnings can return 0. |
| `verify-t06.sh` (before review) | Working realm/resolver and MFA | Realm/resolver existence, list-users response parsed as a dictionary although it is a list, KeyCape token/list endpoint, policies/portal | False-success path: failed admin auth skips core checks, empty user results warn, no MFA validation; warning-only exit is 0. |
| `verify-t06.sh` (this revision) | Known user resolves through the realm and validates OTP | Authenticated realm binding, resolver numeric fields, exact user/resolver match, successful TOTP/HOTP result | Automated functional failure matrix passes; attended provider exercise pending. Does not claim complete browser SSO. |
| `verify-t07.sh` | User management/self-service and registered clients work | Group/user existence, break-glass membership, portal HTTP, discovery and config fields | Insufficient: auth failure can skip most checks with exit 0; no user lifecycle, enrollment or client login. OpenBao error strings beginning `openbao-admin` also match the success branch despite validation failure. |
| `verify-t08.sh` | Recoverable backups, DR and break-glass readiness | CronJobs/RBAC, prior job success, backup file counts and runbook presence; offsite custody always manual warning | Insufficient: no decryption, restore, recovered application operation or emergency login; warning-only exit 0 does not establish recoverability. |
Runbooks must interpret the legacy verifiers as diagnostics until their missing
properties are exercised. Existing object checks are useful evidence but cannot
close the broader task by themselves.

48
docs/verify-t06.md Normal file
View file

@ -0,0 +1,48 @@
# Verify realm resolution and MFA
Exercise status: unexercised against a real or scratch privacyIDEA target; simulated HTTP failure matrix passed 2026-09-05 by codex.
Run `bash sso-mfa/k8s/verify-t06.sh --user platform-root` from the repository
root in an attended terminal. Use an enrolled test user where possible. The
script prompts for the current pi-admin password and, after lookup succeeds,
a fresh TOTP/HOTP code including its token PIN if required. It never reads a
bootstrap bundle or Kubernetes Secret. No password, OTP or token belongs in
command arguments, logs or the receipt. Do not enable shell tracing.
`--pi-url`, `--realm`, and `--resolver` select a different approved target.
The CLI requires HTTPS. The old positional secrets-directory argument is
removed; `repair-realm-live.sh` now calls this interface and propagates failure.
Success requires all of these properties:
- pi-admin authenticates and the named realm binds the expected resolver;
- the resolver is LDAP and `TIMEOUT`, `CACHE_TIMEOUT`, and `SIZELIMIT` are
present non-negative integers;
- the exact username resolves through that resolver when queried by realm;
- `/validate/check` succeeds and identifies a TOTP/HOTP token. Passthrough,
static-password tokens, denied checks and missing token details fail.
Exit 0 means these properties passed; exit 1 means a failed phase; exit 2
means invalid usage or missing attendance. The sanitized JSON receipt carries
only result, phase and proof names. A successful OTP validation consumes a code
and may update token counters or authentication audit state. It does not
create or repair configuration. This proves the privacyIDEA leg; complete
KeyCape browser login, OIDC callback, enrollment and recovery remain separate
exercises. Deployment diagnostics remain in `verify-t04.sh` and `verify-t05.sh`.
The response shapes follow the provider's [realm API](https://privacyidea.readthedocs.io/en/stable/modules/api/realm.html),
[user API](https://privacyidea.readthedocs.io/en/stable/modules/api/user.html),
[resolver API](https://privacyidea.readthedocs.io/en/stable/modules/api/resolver.html)
and [validation API](https://privacyidea.readthedocs.io/en/stable/modules/api/validate.html).
If policy suppresses token details, the verifier cannot establish OTP proof and
fails; do not weaken that check to accept passthrough.
## Attended acceptance still required
On an approved scratch target, record the target revision and operator, retain
the resolver tuning configuration privately, then clear each tuning field in
turn. Run the verifier and retain each sanitized FAIL receipt. Restore the
fields and run with a fresh OTP; retain the PASS receipt. Restore the target
configuration even if any step fails. Do not break the production resolver to
perform this test. The automated HTTP fixture demonstrates the same failure
and restoration sequence but does not satisfy this attended exercise.