coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Validate cadence contract and require functional MFA verification
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd
This commit is contained in:
tegwick 2026-09-05 01:28:05 +02:00
parent d4d61b722e
commit 4e07d60ff1
34 changed files with 1640 additions and 364 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/verification-audit-2026-09-05.md Normal file
View file

@ -0,0 +1,20 @@
# SSO/MFA verification audit — 2026-09-05
NK-WP-0034-T02. Read-only review of `sso-mfa/k8s/verify-t02.sh` through
`verify-t08.sh`; no live target was contacted. T06 is the only verifier rewritten
in this workplan. The remaining findings are candidates for follow-up work.
| Script | Intended property | Actual assertion | Verdict |
| --- | --- | --- | --- |
| `verify-t02.sh` | Working namespaces, isolation, certificate issuance and storage | Named namespaces/policies/issuers exist; selected Ready conditions; optional certificate/storage tests can skip. Label and default StorageClass checks inspect command exit rather than nonempty values. | Insufficient: missing values can pass, network isolation never exercised, storage/certificates can remain unproven. |
| `verify-t03.sh` | PostgreSQL usable by privacyIDEA with required database and role | Cluster Ready, running primary, catalog rows for database/role, Secrets and optional scheduled backup resource | Partial: catalog/readiness checks are real but no application credential connection, write/read transaction or restore proof. |
| `verify-t04.sh` | Usable privacyIDEA deployment and bootstrap | Running pod, resource names/ports, certificates/PVCs, key files and admin rows; absent keys/admins can be warnings | Insufficient: no authenticated operation or MFA; warning-only gaps return 0. |
| `verify-t05.sh` | Integrated LLDAP–Authelia–KeyCape SSO | Readiness, resources and Secret presence, health responses and discovery content | Partial: service availability is checked; LDAP authentication, code exchange, claim correctness and login are not. Warnings can return 0. |
| `verify-t06.sh` (before review) | Working realm/resolver and MFA | Realm/resolver existence, list-users response parsed as a dictionary although it is a list, KeyCape token/list endpoint, policies/portal | False-success path: failed admin auth skips core checks, empty user results warn, no MFA validation; warning-only exit is 0. |
| `verify-t06.sh` (this revision) | Known user resolves through the realm and validates OTP | Authenticated realm binding, resolver numeric fields, exact user/resolver match, successful TOTP/HOTP result | Automated functional failure matrix passes; attended provider exercise pending. Does not claim complete browser SSO. |
| `verify-t07.sh` | User management/self-service and registered clients work | Group/user existence, break-glass membership, portal HTTP, discovery and config fields | Insufficient: auth failure can skip most checks with exit 0; no user lifecycle, enrollment or client login. OpenBao error strings beginning `openbao-admin` also match the success branch despite validation failure. |
| `verify-t08.sh` | Recoverable backups, DR and break-glass readiness | CronJobs/RBAC, prior job success, backup file counts and runbook presence; offsite custody always manual warning | Insufficient: no decryption, restore, recovered application operation or emergency login; warning-only exit 0 does not establish recoverability. |
Runbooks must interpret the legacy verifiers as diagnostics until their missing
properties are exercised. Existing object checks are useful evidence but cannot
close the broader task by themselves.