diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json new file mode 100644 index 0000000..a71d839 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json @@ -0,0 +1,14 @@ +{ + "action": "setup", + "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187", + "coding_agents_denied": true, + "custody_equals_live": true, + "external_secret_apply_and_verify_pending": true, + "kv_version": 1, + "lane": "svc-authelia", + "phase": "done", + "source_ccr": "CCR-2026-0053", + "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052", + "status": "custody_and_reader_prepared", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json new file mode 100644 index 0000000..eedd0e7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-authelia", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0053", + "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md new file mode 100644 index 0000000..588dc37 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md @@ -0,0 +1,19 @@ +# NK-WP-0056-T04 — svc-authelia bind in platform custody (2026-10-31) + +Founder-run in the founder's terminal under railiance-platform CCR-2026-0053 (approved by +platform-owner and net-kingdom-owner, binding confirmed, `bcfbe29`; sha256 `11d0b02c…f187`). Tool: +`tools/service-binds/bind-lane.py` at `034634a` (source sha256 `3d15811c…`). All receipts are value-free +(`values_recorded: false`). + +| Step | Result | Receipt | +| --- | --- | --- | +| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `authelia-config` binds `uid=svc-authelia`; custody equal to live `ldap_password`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` | +| apply `sso-mfa/k8s/authelia/bind-eso.yaml` | ServiceAccount, SecretStore and ExternalSecret created; ExternalSecret Ready on first apply (the pilot's `template.metadata: {}` fix carried over) | operator output | +| verify | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, the other directory-bind paths and token create denied; KV equals the delivered `ldap_password`; temporary reader revoked | `02-verify.json` | +| restart Authelia | rolled out; founder signed in through the portal as `admin` with OTP (Authelia session `admin`, account site `aal2`) | operator output | + +`svc-authelia`'s bind password is now delivered from OpenBao +(`platform/workloads/net-kingdom/directory-binds/svc-authelia`) into the `ldap_password` key only; the +session, storage and OIDC keys of `authelia-secrets` are untouched. The custody copy still holds the same +value as a fallback. Rotation: change the password in LLDAP, write the next KV version with CAS, restart +Authelia (it reads the file only at start-up). Remaining lanes: `svc-keycape`, `svc-privacyidea`. diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index aa5a657..26b018e 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age index 207fcfa..8c7ddf4 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age index 5a879e2..8945919 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age index b4096a6..92b9a51 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age index 7c980aa..196cd7a 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age index 8d0b489..420494f 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age index b5da637..ef227fb 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age index 1c1d45d..d365e83 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age index 2368f66..f0c93a2 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age index 1bddc25..815e68f 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age index b8486ae..0d431a2 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ