Label authenticator entries by user and realm

sso-mfa/k8s/privacyidea/bootstrap-realm.sh

@@ -241,9 +241,33 @@ print(json.dumps(body))
 RESP=$(pi_api POST "/policy/totp-self-enrollment" "$ENROLL_POLICY")
 check_result "Policy 'totp-self-enrollment' created" "$RESP" || true
 
-# ── 7. Create authentication policy (fail open for token-less users) ──────────
+# ── 7. Create human-readable authenticator labels ─────────────────────────────
 echo ""
-echo "Step 7: Creating authentication policy ..."
+echo "Step 7: Creating authenticator label policy ..."
+# Google Authenticator and compatible wallets display the issuer and account
+# label embedded in the otpauth URI. Keep the token serial internal and make
+# the user/realm visible so operators cannot confuse privileged identities.
+TOKEN_LABEL_POLICY=$(python3 -c "
+import json
+body = {
+    'scope': 'enrollment',
+    'action': 'tokenissuer=Coulomb, tokenlabel={user}@{realm}',
+    'realm': '$REALM_NAME',
+    'user': '*',
+    'client': '',
+    'adminrealm': '',
+    'priority': 1,
+    'active': True
+}
+print(json.dumps(body))
+")
+
+RESP=$(pi_api POST "/policy/coulomb-friendly-token-labels" "$TOKEN_LABEL_POLICY")
+check_result "Policy 'coulomb-friendly-token-labels' created" "$RESP" || true
+
+# ── 8. Create authentication policy (fail open for token-less users) ──────────
+echo ""
+echo "Step 8: Creating authentication policy ..."
 # passthru: users without an enrolled token are allowed through (password only).
 # This enables a phased MFA rollout: enroll first, enforce later.
 # To enforce MFA for all users, remove 'passthru' from the action list and