From 7f37e2521f754dd16dc7a41de28b721212452e5b Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 10:11:07 +0100 Subject: [PATCH] NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts Founder-run under CCR-2026-0053: setup (custody equal to live, KV v1 CAS=0), ESO apply, verify and Authelia restart passed; admin signed in with OTP. Custody copy re-sealed after setup (same recipient, contents unchanged). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- .../01-setup.json | 14 +++++++++++++ .../02-verify.json | 18 +++++++++++++++++ .../README.md | 19 ++++++++++++++++++ .../secrets.enc/authelia/secrets.env.age | Bin 1531 -> 1531 bytes .../secrets.enc/breakglass/secrets.env.age | Bin 491 -> 491 bytes .../bootstrap/secrets.enc/keycape/key.pem.age | Bin 1904 -> 1904 bytes .../secrets.enc/keycape/pi_admin_token.age | Bin 4036 -> 4036 bytes .../secrets.enc/keycape/secrets.env.age | Bin 588 -> 588 bytes .../secrets.enc/lldap/secrets.env.age | Bin 1143 -> 1143 bytes .../secrets.enc/postgres/secrets.env.age | Bin 594 -> 594 bytes .../secrets.enc/privacyidea/pi.enc.age | Bin 296 -> 296 bytes .../secrets.enc/privacyidea/private.pem.age | Bin 1875 -> 1875 bytes .../secrets.enc/privacyidea/public.pem.age | Bin 651 -> 651 bytes .../secrets.enc/privacyidea/secrets.env.age | Bin 1143 -> 1143 bytes 14 files changed, 51 insertions(+) create mode 100644 docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json new file mode 100644 index 0000000..a71d839 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json @@ -0,0 +1,14 @@ +{ + "action": "setup", + "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187", + "coding_agents_denied": true, + "custody_equals_live": true, + "external_secret_apply_and_verify_pending": true, + "kv_version": 1, + "lane": "svc-authelia", + "phase": "done", + "source_ccr": "CCR-2026-0053", + "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052", + "status": "custody_and_reader_prepared", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json new file mode 100644 index 0000000..eedd0e7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-authelia", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0053", + "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md new file mode 100644 index 0000000..588dc37 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md @@ -0,0 +1,19 @@ +# NK-WP-0056-T04 — svc-authelia bind in platform custody (2026-10-31) + +Founder-run in the founder's terminal under railiance-platform CCR-2026-0053 (approved by +platform-owner and net-kingdom-owner, binding confirmed, `bcfbe29`; sha256 `11d0b02c…f187`). Tool: +`tools/service-binds/bind-lane.py` at `034634a` (source sha256 `3d15811c…`). All receipts are value-free +(`values_recorded: false`). + +| Step | Result | Receipt | +| --- | --- | --- | +| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `authelia-config` binds `uid=svc-authelia`; custody equal to live `ldap_password`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` | +| apply `sso-mfa/k8s/authelia/bind-eso.yaml` | ServiceAccount, SecretStore and ExternalSecret created; ExternalSecret Ready on first apply (the pilot's `template.metadata: {}` fix carried over) | operator output | +| verify | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, the other directory-bind paths and token create denied; KV equals the delivered `ldap_password`; temporary reader revoked | `02-verify.json` | +| restart Authelia | rolled out; founder signed in through the portal as `admin` with OTP (Authelia session `admin`, account site `aal2`) | operator output | + +`svc-authelia`'s bind password is now delivered from OpenBao +(`platform/workloads/net-kingdom/directory-binds/svc-authelia`) into the `ldap_password` key only; the +session, storage and OIDC keys of `authelia-secrets` are untouched. The custody copy still holds the same +value as a fallback. Rotation: change the password in LLDAP, write the next KV version with CAS, restart +Authelia (it reads the file only at start-up). Remaining lanes: `svc-keycape`, `svc-privacyidea`. diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index aa5a657337076ba7ce4a2be0f3646306711cdabc..26b018e6833f1a1c587c6a06b8a159674895bdf6 100644 GIT binary patch delta 1517 zcmVPh zIdXPXa|&=YV@h;(Y;j9sPfKG*HfL31S7%mEbZ|6sSWa7g~S2jU#d4FPbby_)WZ9xj;47^}b zxEDDL3G8HiRQPa_mBEU{%&Sq9n@c@hS7L{6e=$VkaJ;tnM?`q@wm6t6;``kg~T3cyB z2)b!7?^9zLk$+D|04QB=zFP@?ZD#5C7m^gz6ouf_R`7V93cMDgD;9=-&wHJ55D{dm zrV6ac2eA*%9lE9a=VgU{%>o@jvX&ur{&|0UYqn41DP{q2BE%%J>fVL(|lxp>iFAW^CSQGYCt41&JXFW!IM9mAfd4~}~z zWI2p2MXCZ82eJ(#_tf(c`?YPKBs-Kh_iI^nsxZKkrpCWu8M0z7Qcph#{zXw>qplM% zY?7GEWKLy=U=f{O8(_uXIfPf1+iOSTmS3f2TkM-+NSDQMNTFh8R6Jr)Q0~5U4z{PG zouy~`ZGZI`_oe@gXupZQ3>;ceV=a8<`MuE3X=-E2NcHU*&{-8fy0S#w5C~rpqDHY+ z1~th(DX(GgZ}C(0Y}%`U3K`Oqzc}rGqmGGHeO^c%gL=Mj94$FSt;PIGg^C0e{NK{u0{$Ado2?GH_P{!qV zPK_{aa5z44u9czgFmx8hatVa5dp6K)7H}QWA{d8vc6x0S=|K+Ojg=dQr-ofOQ6Wk0 z+kfF%RMJaj>`YaHON8`vQiZ?3&4~7%2>iwV5Bj4&2Jer#z`Sn!M=ix5 z?(YQ^@@D+~h{~tgvta+5&!&i)ZNgkgdw(>z|4G^c_hMki77H}DDK-JY=UsBA`iwD? zYLqs?nrKadq4oq^?iOt~RICcNt|_Hrv|f+C1mNq?bfd(Ri!{8Qxl2xwU^**!;~Je< zVSaGz+Aate`j9tFV)LWJSMe_=^FS3R$myR??$M6V%z+If0A8(|9w`_>+s7bT>3>z> zyngm=@Fw8JF3Fo{zt!qlLcDqOCmVS3qW>3KO!l(@>0r{&KBHbfYsN}QGPxbK)X1cg z8EJGZS;#uB7YS3^pq1u`M`5WxXr?Abt21($f)Y6#E}-5)OjCBwe^`#h`J!$i4lLZU zCY4kk*E8jStP{T3u}%DjaN5vvkAHtZB!lUG2naM9-`A2Sj>1*_3fenaS=Yf@XO<7G zu|rYeaWgHd_bfia+}`{L6aiPs`S{SaBhn)Snw7aV#0=$v$=@WB5b3KLIQ+@DZ}-p% z)CssY#nC|xyq_HNs+kia6t$ns&1j>Q6eWOkTam~ht-H1sKk}u3e4B6}et!_xh2uoX zzTd_FJ}Fav=z%UQzZj(113=SaC6+jCeedV=?ReFR6gE TlTLKEDdliXMgLjZzriP(Zb;(1 delta 1517 zcmV1MPE887v{|rZ zEne2Jp*`3O+eroaI$qrq0mlVue26EGnlEd|>t5ORQJl5o zaTw?f=!f?7#9J&IO3RW9trv8UY3UTUL4w&I$*ntuq~XXYrsCR<#2ocW>)Xk!-JZ)lQPV{heEGHL3lq`2af3nEVMzPkGP z;iG)met(&9K?EjY5n+Q;n!x%pH}C)x58FK);WZ?h*cUQT3K4OTg-M%%BNOw=e0h1_ zjtsxzF87nK*rork%#?0E)gWX^xK45l5^zXU=VVheAD2@lkr9Q9FfB&POhW;2+8Eny zc1V@@5=DkAl`qh8o+WKA`VeJjRM2+}j+?ZTo_~ZZRLiT^SU{#9+wEZhQwaAJ?>(xv z#5sa0|MhcD+j_giwKXS8{m{ky-AhS#+6ZYpCU(dCrRs=eqIB`sekNTICW#8hPwlfi z^M|SL!iilEEkhjWsQR~KDBikM=uS0|T{GV!XofmgZjN-L{!-x$55(MmzZ6l{u`YW< zuYc=2PNXFU0%08p_Vj_i1Br10?$`=jy~GeAJC--xGT11)PZ_2eCQ;J@QaK_b1*yD9 zniJ^Fz?IguJ=)ZR+q$C~Dyy^Svx-VBvvTpDvqiiAZgDJewPxISjV1Ht^{7a&$eaF^ zMmKwk=k2V8HyF|ez|3V-rB1BDU=YSl8uuTIBZVs=8!i{^Ef4u4V1 zzzk$7#O3k&&5hS-_KY+~uIr1C*%P(P;K0XDV1>0H+awReyF;;0?w$bDOA)FNyZZ?@eBmib>w#4J zb>fK}>foC00X+VK9OhB{m)}_-L8oym!Qt4QJ2G~Z`G_^7D^52(++ysW;(zt>Emly_ z^`>dyHfAOL-$-+k)xBoUFZl6pd^>~!8$($LYM2y^0AQ~ax*jd4C4!;f(AD>|s_sXv z1J0masQ?f9_Ej2Q> zwZ;rXU}JeX?_l~%J!F6S@n$#4QUjD4Sg8ZaxYz;f*ULw1R(TxFYH4z6bz*8bOn*sJOJ_-OVL=L`6K5 zX;9_xhv(qqCN&UsyospFu7+v9;+sr!a2baNSd(q~&)dV7_Qs!rP7oEHe!n1mfbu~6&Gig|OQ%h@BF?w-IR#HZCI0`K- zEg(fJVM|bSLSavKYEU(HYC%LYFk>(>S#mR1P+>Dfbag~@dVgvwbT&h4cQgvdf121q z`-#4sWq`xRCCA&$fEfXA5ZrMpZi3DynH*(LD_PV*B@XLPz-y!$SpO23dWopoDEL#G zAURjmsCmV?yN$fyYgQEf7K`)Zs0!J-<~RF@zld#-7Q``nYraZF5L$l|j+9$B@F0sD zXkxZ!$z3A2(tkl)RQnq^aMf3vH~ST&O`oNKzWiT?p*=IG6Djvvvlj1Phbw6^(j(-W zU0-4jM*@wZpwhHj2v`r~#LND{RZhac|E7_si>QeU9f#WDe){TY&HJ!xJhlNIbK#R5 z4JK}H*rw`}4tRe3Tw~v!Cv_bBaU12#wE#5BOBJGwgprv|s4+J0c zjg!^rLsm=-JV;>~mqjDv&2y=vEADi6z-UV1*e_%udvYJpmWKXGGaM#SawcTSZ#JTSxr$_Yfdy(b}}+;MG7q~ zEg)iYbW3ngHcePVZF6d4OIS}eM{+eYMMzahaB*REHFI_^Z+}&0RB&}{D@6(ua+qIq z#Lo4N0230w#Js}Nvbz1CRF)^0lt_iFM;{dSViN;Y*wf63pd%#g(y0hIujq0@PM7`zm@usDXxad_$!xZjK#i z2*I^uTYUT@3!XwMO2%owulYHLp8n70774T~O(RbSPCw%*ed@eig>f~<8Qp5tbElNP zjg1zp0T)qskyTU7R9yP^a#Y8%Z@iH^_mNyDt@D~)3V%-ukJ{}aM^#a)YsFvje2v1c z!NmI8&dP5fP1VV;%tTL(`m~tx>9H8qFyeb>eJg&?hFV<^j6z*24_6!{?P}<+^kbf# zD7xD|#tK&|VOdG_In$$}&l*4Y7>GK0)#iM~!)CA9pyc$TLI5H_xj>vgK|RZ|(r_Vd zzyd-I*MA?F8VIk(=~5bdEF6r_F=;9euY^<5w;l5GVq!W9qaZddM8AVt|9oF$Wxx=zd_8;y_1>#b?%w@!$a=ige!7CUVq-A zEB)H^1?4RXj&WK&_@*$zXT2_rlJ(RT0Z+M9Kw)4&f)4k9xqS`e><)}MI%WJlFMC$U z4{)uH$$M`<@Cr;cWU}f0qCpNfc)6%Nx4la8FF)mB3S%C+J&0^aZ3{KYm->$3jKHQ< zKcu}dwBX1H4$jXm$;!0-A}|fdKY#uN(T0M;)t55cUH#*d+l{p6LYCuBMhebyx4M4N zCV)N5vdu=gsG!*BlB9@%^rGmhryVdG&Uo&jzt5tkIx}mwG@Gk{<)c=*YH@Zw->z6~ z>JI0rGk9F9aT(5rIt!iH1!Csm@Ev(2{vnC|0h08YiS!`ZNUomKd-z7CWq)=#OaC%m zIIT$tnQ|xU`a=5xeMP0p#l|*K1nFHD3~|n_pUJ=q$b)PWSzhk=W|nlziAn~CpLa}P zBG~VN*cR>i1Q3S(v{^Gjqo8r5Ap}SelJ5+2O{F!s?y$wn!^)(`ni(==sdP_vSTrV& ziI@b|M7PBg@gvp0RuI6&$A7y`{JBf?xjI64*MY;ACH@D_B`%S&4{#OsP3!$+YbCQ- z76}e&Dr)4?;h7W2AxXPr+J7fhtVZO;k%x<3AMaf3bkfHbkKM%8LmKpwvubwOpWDkf z$AX|F({puzSS}7^x-jN`k6i5}vQ|soWLA{_CGzcA6``F}}xujE00k&x5PUQhQ4tnrtWr%72M?1wOko2T`Ii=(g=Od2W zpA;f!tkjZc^LFG7L|gT#ww|C+bFY3^d>K*RDC-Eh_|b>rYV$EP6F2&&8?$rMoa!K_ z^K;Gp0J#K{YNiBCwSP0698I}y!N-``C^q~KNX`B1q1Tet)i#Ahy2ap#&A!PZI_}r_ zEQIDw)&Vf?M{WjO-2iz<%v$$pdQb=>4J|`FxThnZM@D~qNfs^Hoth`0HL-#{^J_E| z{z}oVH@oRa&gED!*{E4K1UP@+G-60fAt$uBl`^xqpsoJaq+SkU|5*iF8R0?|b!Bk8 zQr3}yLD&oq@V%8Amr2om`p*qqfLo^=EXjKw25Q{=!byveef@ffT^GR*Y3sG4siA^g fLOE^VzP)A5aWKno@LuGMeVp45(GEhlpV>c^j zba`1sRSGh5WO_JfOjt8%Nk%YiPIh`LGFoJCM|fImYjtXIH$h=xc|}2DLri2dGzu*( zEg)-mdRlUER!~P{b4zJ=a5zRVS7&ByWJN_(D>!F$O+<2eHh))1L^*kPZZHbDM`B00 zpKf5AGK>-RNO)A~s&kn-U62WFm8-LDXIWh5DFZ6@cn4^qiH-kX9|vU84RzE7-P@syBJzI}~5 zRZJc>-W_pWT7UiN*$vx;vZO*OKY?k%#^P6Ck!`_2*@*Unw%;7b;zZcs?$mxWOSI`MehBvYwf?hp<4?xo+}93|W@HUL9cYX;d4I9h>$Z^OKjiz$?*`T973}zh1^_;XSF@3qik;7don7K)7_-ydF zaG?eN_kY~aq#nzjDvod%tzFfz@_pK*WVxz$Al}7ZbEauiDt-l?qn zB8p9wqjTXuBswK2jwUO2N)drxl^L<5_PaSl0Vo#jb2r)jQA^8K5oyaUsL?%Sw10my-xg9LT3zur&fYZ*9Gth3Yn%PV1^lcve1`J)bc{q_#HP zk1jX|Fi*mhdkgr@3xY!LqvLqvC1&I+hS>5SHZCX|Wh903#v zL2m(`A@-|!{e}OoGE@pUhkVJ`XMb@Dh9vq|?ThYgn^q&4#7R+BZb!rOY<|HLWxD|D zOd3KNcN1mitc#n)^pM%%G%q0u0DqPw-%{m@8+$z8Sn{(?KcgkTigY|JEk*|$<)jEwtC1Lzv=KHEjpl%B4VP>CfvdaD_kbam z8U;~S@XUNU)T{b{bA>TF#3urdA18%SOO)b4mDDGqu??`4H7P0zXJ+76@owUz4wJ4P z#STP3EFuIpj-_}g_=O!(X) zsXEAhJCx{1m9K!LgKEwprO)Cz0!}hRhwc}eXG8r$3K247-V!AanP-$$;d^48{e9K= z@u0alhtbX}%0%H@Ap5f1FM^5Ls6E19&eIF38Ig;0v?(x3NY@pftAB0+0kQ$a{v;-U z!t7i?P>yigh=I=6{-%6aXwxHpu<^Wc?_oqFHm#h^c9J!i6)r|H48UTJ4o${(5KtZ~ zAyIJZRkUj^t30Y1#)J%xI|DC=+%kCh0mJfDdBo%tQ_poJUAnN`V6sd>A#gG#ras#h zQhf@7;7XMJL)ZsC#DAh^eYrE{koqQ{#ErV9t>|V}#gK;Fwt4~V?vln5jofwjIWFr* zpQKll3uiR-reU}hA6^uJ~>8rn`SDIWl zWZSLCIG{*6xfeFlkka|XxxJoBb&6RE{Q*Q#LI-(A7JbL#n_d@UX_&zqQ)10pVy>wZ z2<(ZOTdOFLR@-HNac@rWEk~+0w(Y8>Zzoi)l_6!j&3FGY*4g!Od!{8&&j^FUW!)N} f_;F*ff40N)8wtBRlUeWV|5umLP3TzCEeoXt+M$qc diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age index b4096a646ca3bc05fac1f7ad5b11234c8452dc72..92b9a5123dacee51c4dd8b0e719c7404cc416b7d 100644 GIT binary patch literal 4036 zcmV;#4?FN-XJsvAZewzJaCB*JZZ2L8%Gj3%uLoZNe zb8A62OKo~mQa5WxX-i>RWM)lvNLoowcsMXkF+~bXG(%B(Q*lZ+dNfmXPhoCQb~blO zF>Y^nPE%)1YB)tid3Hi(OLsO#Id2LrEiE86P*8bKRZnt8dNOE8D^EuFF#B?4V%LV9(DUJRjjQ?|qcPvx5I(PuE z;2Y5;OVX;$awxY_!QuuQ2IYau4Gov)#qsPL1Cr+2Ca`g452kB>(qk&r4cF}i{fD+G zX&*n>D01oo{rqjK7T!00qdngKeZ-xyh)DLiqvT*4tQ(Q~&5gY1^A)iH z#;j56l6+hmV9%~+jofakZO$-flmfoj#9TnP6SC5#4yO|XiqCJ9Q}m6TPB@wili&0V z&tMmSx9X!ymwgAyo6S?2+%dAp{X(C8uRKmohe}+eH^4*C+k7>kDv!_I8V+^?Bt6|kOCPdqmQt0VsJlPs%p&)aOulM0!4!R~wO_Tf6294t2a3O zS@JLHg3i5F?l#JYSUD#gVz&BlHBM1wzGSUagPBHTyo<~dtMiS900)PAJ*=TLOSz>w zf|8{oK2aW!cr5FPFeOfL4IzX!oEv8ZYYnNid_zdk)g;*%r0r?~{y%G{@)VJFPtvr=w-{{rC@}NUwIey|bayw(}XKf;^r6uOc z3S?IQ@Bi=SAsVuePJhN89#tuU6ezk^IOd4~y7Wl+pV8EC2d7t?G7sFBYaI$@a@l{4 zhW@UOhS|ZPS@OJMOp6+mEfD_s2yRb=_T0M}E9eP-4U)BJN>(D|l(2~X&+|Z^Hc(cS zl=>{Q&6MJ{L^GT$jtzcbK>Q>t9q>A#M*!Dc?uQ zY-L@cNEpgbB^1geXnf@zW}jetce4wNbi2mVa4sP@kH=aWz1Mjw_3*m-2T9p$$OCv$aZEoL7qW?k3<>Tt|O3+*Z79Y5U?}Ue<)K)Og zX*?Uv$ZAx0Qa(;*fCw2;8LkE12R;EjO`%vS*3j8O(31g7&HVE@Hzk3d%z-6KM}ih+ zXKI``mGpLQcp=+A7(b;9Ihk*9%H{Z#YT8#VOHJ#AN;$g0!pt=+)L&W$I{x`<236|5 zh;CPv!E(}Sh;)z-?WY)JDFo5^C)E)u1*sr`QpVVjaB6M@E8iPktw zZ{`i{^{K+(B~17f5nfx2eA$wL@F--P_5!8VMg#lBpvMXklKB$b=OelBFYlmnTCay| zz6pPEb~qiIq4)|69gOMbz#mSA`YvIu^;*d<3#b&ssI2bm> zK6IJ$jH8*_nfwe!Qsdkc7IoWy4r*k3|D7)^)H(ZCqw%Y5R=+V}5v_({7Hef{gett% zRtCtnQ6*{Yj3==EIV=z`)-5uTmS<+5R>1pwi@$jH3|$W0Y?!NXH8 zAdKLptmpf?xT-vE1puUchwkR#u1zmDwQ+-gluZrvXp4sDD~Cku#98Er~3vPGW-CHQw((fp5ET|Cp5-=-a4z!WiGTYK!z z7Obyy{ZmJ%dnq#8KH~%3k66KZ zBNsY`WSc`eqqjkvAFW{$_7elZN!C+h3sHo8>dWo*RiF*THl+8AjwHh)vn>0La4Jtv zj(Xo9Qvox1+>uh_Ds*OlJxgR)42`@2)NqO2_Vs|(yn1`kF{H*Qu_wjH78qkT?T)6o zcynqvI)bQ-*~awhnoC8G<(_m6k1J6ME3;h;#P!}k%{Y5 zLj7d5!I~~kkkk>Qf!K2jD;-OO2WwS_R>ZPy>R(+W?F}?c7hBx!fk)_ZQ24Ny^jw+L>NPTJopy>kw$W$ zpSzGkD!Y-ufz`Pp^uGl}#>v|r#nB3ZV!NHg*xUF&r*>(7`guna9i#F$yKRvSlX=Vt zJ)RdIIVHP>#{ocFo3Y)34`tlVX zS+vNR|P{QsW}b;*lt-7QlfbHE7PfcewQiDr+;M<2#t`ks4K4@dJ{orD|ZA-a1&m< zU*4WoeW+msS1RlZJHE@4??Up(NDzJ4ipTK@cA6h9xov2+gvb9zkIj=9~1J#=E@hud zGi=}Qq|}9PqSBM31c=j#a)KHPv9X>i?Bi-iu!I|KV<~qCAhx}FUVn5^WrBhP4Q^c~ zzP8yn=}$g{PZ+efSXhGA_@me=6QLHq~rTkub8%>9ui+;)3F zqc>lBd*&D=BIXZ6*siR@gCNj21L`p@7uU%7{)ctXbjZWDcXDLF&KzNfUxXDBU9^rM z1YZ}Tv_Pod0nKG?-LxCOKbnv}-RZ!PE9v*#L;hnSu!2Zn)6BBX`Q+?rDsh`(4tr8! z22vN<=(iHAGis8y>Tz0oP;KLu>TPQ2rdFo3*O&to8UDQyrZK!9g7xN2IoMJ##$;iK z+3w5GWIYtzaRn!fO1!S>Ds87xX4vz;`W7tKItEzs3@A>U8SyG}zHh6JR6!91SEnIV z0nbGSNifn*uPmls4LB=CxqW>5G*$vvv$0{ubb3T?0kcoy?m~z9EgSgnD0)eKl;D1k zDU=Np_A?;6E-*F@2&>J2FIL<`xoF;a&J9Or%cIPdKGaGv#rQo0+c*0D3dlA>wK=A@ ztE1(?8l1|@zWK;YhMn3OC(y-(w;R&%*|fhQ_~R5NM<#8`oeaV$s4~L7(xzd^sD;m+ z_grmB>dzUD>;a*sY&&VZrQ$zlMj=wWFp;}GP+?Myw z(U@iUr&D1Yf*3?}uXYxU|FM^5lB(?#t_J%)$rY-70V*YlLy_yBf+`ZxP9K#c+$|u*7t7aKi%&A(7i5m(6|_14 literal 4036 zcmV;#4?FN-XJsvAZewzJaCB*JZZ2)(vQ*SguRyb`)cu+ERZelPoT6lJ5I74G%Z7>QkW^7q@S#Nbnct~n5OhZphIch^T zQ&DLzR#Z_+L}XGnNOf-hsOybLCcdtDZ zr{^_PHE)YYgF}{90LxFuN-;AD8v$Kq%?NtHV8gXrs8N53UYA6S@9hdO8L8R7Evz1M zzeM-~CC!eF>SDeDq2wHm;5nOm;Gpxz;dmMN#N@r3U3Qg{y4*#4-Y&asgC4%Re7mr= z7|*w_IVWFTcNhY-Ki05R0dQg%#nhC?h28oGd9$Yzt?I3sdfV4++PCfu|#<^qa2>K`%FCO zoQ+wgxvXb8%$^AYMyHN{ty?CV1B`cnx%MO?vIDf%^zHf8_6li$gNLI!=M_9+9j9`+ zOaM|8+!>f?^ga;h=m;g*5oWn`om?I6?g0Eecwfi$3)3G4nju!#pEzRaYk^ z%*OxrqOz%TUQqnO@`i55mlt}ZSSCnmSGr}+h!Uztr)y)Faa`k66NV_hvV`Hy5RN^T z?aV0FP<^_Ihsl=)=vF=EBOe53pdL~?q3kZ`8A5zfv;!nbHae4$MYI!p)=%rl+Laq)@KNO0JmfTUBf}lJnrt0m8EDnFs<3z-?xZ(24#$i@pXH~pc5 zD7d31fgUwN$0U4-xilPSO{wL`xIA48w^z&L3*cxl0xYv+%*OXW{OJY*9svJeN1!@t z+~7v&%2^<#5>x$3nrb=mr#gDoboTri?i2aFu-pVwed+vWDqkhdZMAqr3>(76Tk)qFOSPKg$qlBe z2xP&{96Me)a(PT~(?o+W^D^JUgz!8~3|R;%CdFKX+Tzf-H_V+WwNUdGjsIIHzysev9fjl zfn2tMzr@LI)^xBX3QLGk?1?N@f>sJDRoinEYAaS0?lrKpbe@C;ktrtb;A4-U*v#v& z3!9H-r`O|cKk<8^USQdWU32>zT^f=?!)b8R%Tm?M2)L|-p#E$b;aU}}o*6FV08L$y zK9^1f+C2qRQolKwzqdyu4%PA+F2cb#am+Ok*|G4|VSR}=+jaukK#2NePj?zKFL&jq zCJ2m&n1@{TD&H<(UK0#0i$-7ugxiQ~PTqOxnkF37D&%q2?N%+4udPsP0S95g+YT{fToLKNHD|BluzLk;>6rT%OWHmS;j%H;T5&MsXvz5fie$; zEUf?%@byMTd>jrZk+5Y=^Of(u793m~b{MpIJz)SKo>KmCv5f*=Mlva7j{$1%<(YVL zpaE;Hb96cs?{`Vkq>J88AOu`?oOVn-xx_`}`GnEf)H_+j(tA%!OR?bZ&?oOSCq%jhv}f~QovNIUFVo&q0ZRI8c2*8u~!GgG|{1XvDbFMv7CJouwoyeBg11VC6jJ9L-1?AzS; zUqa(!s~q}p#imSrWcd9z}Z9 zz~Wg!Lfs{8h?;5$L!;yl{g~0~J9rX+;l%6aXoq%()#R>ELnV4EoCTitG@_!O_>YLN zw)s!>3pIv zR-_-)u03s8y1L&2K{VjWOJ*2^6@Yn&(Rjek<7Tg+NMCkq+R=1lZ~;8o^DVZ!rW5I+ zxmMMo1+x?r_L!cgZ-yp%kwspr-wFqLRQ*~`kg9iaF}`5Si9(?3TA!l~kg~NO6wMKK zB`rbIdj^qLSjcPQ%YcKMUuTG&jGL)58|k8FOg=IKl;{y*$+I1fH#c)sRv>JiZ2=4( z&*)bqz&X(?lx`S0(T{b!ifmj@3vU#qY3BOXIXWshQ!hcH4$Ztf5I92LN6Cq_R^OAU zQ9}9|rDs-G{HJPSYvYFIu^Om8kTg9Vr1jG9; zKoIe?je3s=Ls(sDF^qJz#A2XSiC}_SA-wKOXZDM`5f9vc*g(Ru_BESP>mS9QXsL;d zi^PJEcX~yrCqzW(qgRhC91P#`r^;=gO9w|IsB=xLr zslv54AMgUd``|b~K?;YhdytV^Vr9ox@GeYEn?%CNt}-c@I>(e}ZcKR&%UOxAWGBeJ30a=0q(jiTs-33weMv7C7Bhx}?(4 zO>n)%=?|lza9d`+8h(t!h_oFBhlD_oLdM-78NofJIc(_V4T6q+4k#VM^TKszsn@bu z&0lp3bGY;N%}l=iem9NNoG6k}q$&>@=^Z|*&%-ds4}iKt@dWoTECo-(YA9$wAQi%W zx-~eA3^coSUhd4;79Fz3KMS=i37~XGw>b1Ac zX>|kL;SZPg@A*jkS-IOPkTh?5-Y~Z`o1Ne6JS+!l(F~gYn9ejupyRIx99uA%tvzjY z;a6pGuT~YkqhM=&$a&S+^|K(UgbWpIC|O`mSHsk;jRw5q;k*EgJBlxc7Hz!)+~64! z(5U{I%Ve zCgR+fkQweOxgksFC%ZFHVCZ-z(L~{1Mi$S2aC3Dl6K65@(O&u_sYL7LZ&b^_U0^t9 z;yi&+cN6?&p}W%#vs*HREr5?E4v;sf(CrvQw=UXVT&7|qtkpq&To~yethn&@2WW1K zQ+-*nD%0}?(C#X_a5|{4NjF!$uhOdbczS&2vz@Bm^e}T4Rfxs;erD1-AB#Rt$hgv) z%e2+tg;L$beJOmmt?qfQO(Y^)(CYT1VN!G*C*$r%^k(M{K+*V^m8EHmqyx(1|Jp&U7BE~<1 zKgY-XuZ-h=ERHT)j4XLgtEY)Vw0*Y1;m quy@*DnjG?(3aKvoY#~jh5&#`+D-ORG%) diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age index 7c980aa1ef13c99cb34e5f012fb2b7c4d82ea088..196cd7a9abc808cf3c4ebb97ec660fccab0cba01 100644 GIT binary patch delta 567 zcmV-70?7T$1k41GAb)aqS9D=;OfzY0YeZFULS{~9Z(}xgFf(LsP;Xj9Y*tZiLSagJ zL|R2?I0|EHLrOMcM`9~XXJ}|zICeE`QEGX3WMpJcPcvCVP-%2GMNwB*L`PUSV+t)T zEg(-raWijaaBNd~NpWLnH+Du-NmFi7c4tX#P} z8K@n=MYT__IPJ|>32#CUKJ!~P?(OEZDsa?+wDUSkC(3mga14K@ZQ@5`Q6j%@hwBSg zr-a#?(|MWScYnucEI~*fT0y`rXSj-F83oXh6GJ;W=_&(ia~|`~Auh|3yMw!GEbQ)l zOJgEdHt5F6yE#ub?)Day0h~&?F-Bv@s}T|RC&#m<1MP`G{9j~pPBuQQM^(0$E=@`qARzp@Z78aXp(jhL@BLpLmti``<64X86-2{GhE#oMIV` z3`-QwXT`c^Hh904=emHJcB)!LpcZ$KF4Rqpi;`&4AkOCo)l(3*7)Fl^FCFIda+^CM z+45zI`UuIy^Wu8<)Xw>8!~Yk+jk+{ww*DS9;=Qq$Gkii95CJmf#XL32Dh<8poYdcd#hooxO!a z&en&~r7*YgDkL`Gc2z-}UYL%|U9v{gH>PcJy1chx<1VW?RCr6YaAB?Id=|v$kqH9g Fb%U5(|4je@ diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age index 8d0b48946742e03c1b2530a8e5879965c9870c4f..420494f5e9fcf57f8019751085014a6f4be49ef9 100644 GIT binary patch delta 1126 zcmV-s1eyEy2=@q(Ab&x6OinX+baQ7|N_uHGZ%c7OcyMl7D^E{TN_uoma%gvYcw{+F zL`8B~SqgA4S6OsvQ&3BGdPOvMbXZwMIB8~OGFWXyFj*^EQh8-jcw<^)aZE~8YYHtb zEg)k|YfxiOax!jdLuoc=IAJ$Wb7eGnS~fRFdNN3MXE<*;NPkvnQ)z5xPHzgor_?Wb zIC2hlseoc)Onn{S9+sWrny^8TLE8b*wrz>;Mi4ecPyXyd^V|%llpeQ+(%9x*i2)+B z2M=f%C2!r3t_wys;y8SEF?dk_Xr#r!zc2IM?bA1|nl${agyR%@gX(V~olVCUQroQn zT<$Gs`>Gn)DSy8ZZT#1Rx;~g|44LpGw!5@?2;{R@b@gzQ9(Rbr6dJOkaGyRQNO6zQ z8n!xC3>*Mgw_8~NtOEcfi1Utbb@qW%qr!_VYtP(9iXy_GGW-V5S@UeCU7j&Sn-+cM zK0^E@uv}e+P+T1(VBs#?(rj|`N=j=7{;53uI^FWuQh&}sbhL6mO$Q512|?Mn{<-xDc#>f`jgj-Coe&>EHL)htz0GZboO8AgcSTP&Y_R2J?!M6tS<(y z10R4b?SJ=x-b`-dYTR(~L!XIz1NkJT2?helw%oU-H1!VpuS)Xfc}_3jBKcx zZtpp=(d5N7wxsZa&lp0K8%{~H$3&2`0yrg-aWfS0{YP~-jM*zzEm7YMOTc~JdZ-eO zA_|#D1Mi%%%%>~tl@6uD3%-DkosI!hsb{tgihqsadDY)cK+osz(5=9@+u{hz7p&IP za2dQe@}B;LPW}a@CO%@_OCZdV&X+=J8cHs0|89SntFk+R4LSUEN6Dcl;}%qww03^v||Iwnf@CU%}qe zzJHb1F4uWM$G=rA9}K=EGoKenab*Jd4$Yc=nK2;tpYEDz%n4v3ArWAR+G4VeltApp z^(8zeeXJl!DL0IR{Ia%W>auKn9h?*xeAB@2u%6dwkG@1Xh@bCT&f99XNso*uBBf&E zt-%%frgYG*z~`=}V9obrEs1>V1KAtZW`E)l1Yzx#VR`t|1z6Hy>k<|hy&%{=#x*m$ z=*R?l*xl&2DE$-)_@~-Ky}0eep{&5JOGotFMhRi4Cusdh$fe`JbfvXOM~-eh{ghn- z0hKY6cDNKy@WG``V3Fqi(f44fYd-C<#W33!<#XyH{Wj*BM%R2NTA^dq-e643_(WO^JN{@zU2EfMkZXX> sjbDqY=&V1Kgc!bv2wpaklW_S!+X%hMrTTL&dcN@NkUXaQ#NULP%>_3N;O1LHFHyWc}Hn8 zaC&ELK?-U&bX9UhI599VLvA%TPfj;gLMvHTb}Ls&YHMd&NqIDILTzVyHaA#WK?*G` zEg)elFGyoIX=FldL3nv)D_BN)M{PkwRBT~HVlz%vOL1B@leXaK4+FK;`Ucn&VE&Z}UTvIY_a9;Vr_N)?vU*A>> zp@T!Huw%tWY1GWs6U~uxKTU%Sl~XS`qzO#Fc6CsCQ%u1Hr4<$7rO7!VnA4k~MW5C6 zP*uNKzKK?$Q-9wdoOE{g(}zPHFdJej_VU}ySb76=8O8V2iCfxCL}Cl9SFN~_6Rdg} zSq{af*tVtV2wY@~x%vJp2s2)#XL4tKgiE_vg1IqVsS&bR+;Ix?tW6r9>{8mP zQAYOqK7STsJn@^aFg=ACqA3#?9y2--rmGENTw%}s^{AilZf+vA$Q}Ww8DfUV=@3zn z>vct{0)aA`SRc%6Z$tjHNUrXy=(A9bpQwjk%}XlpmqmAAH+22e z3w^H1%Yw&hxfC%|F-hj(e~iXhR7Q4@x#CBCwnL!751})aWV8PJ4JQ^G2hlD5lexSASz@85~m?n{#BU294qXJd)P8VZDKiCDt#<8@@+)t(Wg%%~Z z?P8mLg^f6J1VVSa%%|MY$lX~hyVZp diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age index b5da637a343389a7235ab55be7014adaa157cfd0..ef227fbb44540a27de99e1bb4102c751d619286f 100644 GIT binary patch delta 573 zcmV-D0>b^$1kwbMAb)H`OlD<6MpkS=S7I@BF-mV$G-*&qIcirpPf>JLP;qEgRx~$6 zFitCOa|&v9WlU^Zd2M5CLvL*{N=ZjfNm*J(K~_*PWlT;?V?|{vLuqC?Lt1D@FbXX# zEg(5ZN^3$zM`}56F-JmLcyd%mR7po;QZX+ybVo^UK`~KEPk(nZL1J`GD^UvjnRf$t zcH)uky|Ckby<5q-=y9%??+U}Q1Qh5(2*U!ySnGllW7>=o)PA{QPyV5ump)lV9yqoZ zZW`*EKQmO#tTqtHQ6kELx=IC2OG)2XfK5H=Kd|(B40vnum6W*k;CmAQ*Eu;fD)491 zg54Sd&28z3e1EUL`)z%nFxzg;8J@c*z4Rac-^mBxo5MS?u4EE|^8o-bMVrhITyozq z>0<1s2fiMjDhXz9=SO~7{&|9avPXprQHzM{dnrDNbMIpO*JcY%76bY(H&L*c_{&GJ2Q1V!=01N?UXkb2IG85Y L>l$~!yeV|8-QfJe delta 573 zcmV-D0>b^$1kwbMAb&AcFmq39a%);SQ7=qxX)<siUSW$UPQ8rU#Zev4wZADW;ZADCSN@F=VFJnu3a9T1rSqd#J zEg(ToW^Pb6R!nd*VK+-xRy1W%PGd)5XGcXZGi_~AFGx&BQ-5uCT1jeDO-Twk*<_~Y z#H+TlxQtSb%=jrxgyc(Qs>j)yN3Ph(=1g(P@gI4hF5&_5oOj)Og~6S?k)&G^yGqh4 zgCsRB{rQg#RjSiExaGqTA|UN!B+~SV9qG{So*8)Pup6|H35(N0IE?l9DjneI#rs%^ zz!v*^>y#l%IDhCl8sM!sqjTc{PsX%7jBiWiM8YH_?!1WPdhG6~jly~$3pfBGAtDo3 zww~ab4=H3sf&n{Weolkjs9i~zzcc0x$q%DY58^eo_eHNYS%@c!bkSTg>2FMTW{`>$ z`WZITJJwaqzf{Y$Qbe!s?X&6oCx61fUTV32G>bQ^@qg3C;TYDfGD_2OxL~V^#T5E; zuwoZ+z9fTLS#1-9RhIwi61@vsC5-&~(zB8b@a!c4Hsu zm@Y6%xHb>H!y{JP6bwiwu=*Ry0yf4u6#y)WSZcYZfq}6ZdXA{a8PhHQCL-aW^8UYYA-ZHPgXZD zO>RPC3NK7XI4@6TOnPBgLv=_pH&ahhRc&Z$I7M}5YGHXXSy*dDGfa0uIBrNu3N0-y zAX#^KOGJpw%vWDWkP$c=A28e8P2_uxyrl-j7=wQ33g delta 272 zcmV+r0q_2(0;mFzA%8edOLl2xS6Ve$ZFw+vIb=d_a(6UHSbsQSXJ=JxSqfs=C;pF!^!s<3)2GnfAC*M WX&Gfh?cSB~(+O2KUbSO$8ksjuFL9j! diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age index 2368f6660d2f546c6a38a112ee07ef12c2ad4ebe..f0c93a2688349a276fc7095c37e22a83f58fd653 100644 GIT binary patch delta 1864 zcmV-O2eoP*F2lN@_MsHg#w#GDkLMZ8B3Zacf~SWl3XsK?*G` zEg()cSVBctY&AtTdRk66a%p;TV>xeZH#Ti_M@Uj_M|Wg&dVgeZNOo~{G+7E17HYgo zu#`@niTK$<^R0l?6u3QU@bGNAssS9sGdmkYFls1Q${j*iZ&S*SYCXSORkH(0VFm z9gk2LEAx9s09!f@H2;HLep-$}pKV(E3hezm0K33OlJRay zWRnYTTLV8#!Un+#1?9wwC24E5rL3y7O0<)a)XF+c0IUz~ zGRlb?5-w10aUd#onfYosK9cmO$`0*>s7^d=2N-z|<pP^dLsHLEM2xE_xxq2N{ zQLyFQv_^R;d>ePM1?F;wnDUn*IFv})7S+^oZ&+TE*DV7 z)qi(XN7+{-{g%aC{E$mn8U64CSkfy{Z6W=6O{TVXjh>q(_<4Nie49P)$8g$RLGn*` zUv-A#;5M5f85NZUhP zDIRT(q2}1}u=KR}-zW9=qZN;?Q};fYgTW*CL%NOpS2R8JVozQ*y?$xNxz)VF2Qp!E zJ_wKqR=Mx)_VbV2xT>{tKOT9^_hsxA_29Qi6_AFJ{|U>WWI`X8!jb=Cya*pe%A^0zq^{~m=J*8%k#49+!mK|zNqh=Cpqofe#|vpW@tVb?4RoI0^2 zd{~gaOKh^-KbPKOasE)D#7iJ|U_X&svRxmY$J{Vo-iuT|r&7Rl(@+JVl_mp~YsQ9$ zO6&^IE_`Dv*x(wJ#h}Ie+2cog>uV z=Z8}Dn%TI03x`ur&>TO6PUH3uvFw%DnvoYThA(8XVbmG+f^;G=iu;rOzajM^(eTsW z`zDTzuP~4d>z$4n&w(v#R(}Ia$?4{=GsSh@T(6bloZ64H9=QG4E!#lp4}}$e@O_Km zWkzgf6tD)tYt3w(F;RaKB{l^w(#i@pR2R%K`R}hAdt%B~CsJ`=P?6**dhr z4W-ZV;gQ!$OwcuHSY*fH7{J^41gDPVCF)jdgUV=l+(gm{pF!FQBdyn5^tAljm}DuO zCekmeTPy3*!|d{2S~xqW5(b3-JBgU3EJ*f*QR$`|6HQcO9G-mD`4H)LCxwE~KDLI; CdY(rB delta 1864 zcmV-O2eYsCYfngXWKmglGI2RmazZ&qYesNlOKU|& zH8f0aZwgv?V|Z~;Omi!5FH%8qRX1c(SV~qmRZ4niF;914WH&TWS2H(xNKi0jcM2^n zEg(-)RY*B?R#r-BPc(N{YGq_NL}hYxK~8#Mb!vArHeyajFn>u|LsmpeSXm0HvU`2f zppJVc*Vgkr)v7FG26r99{xp!bWL3?=PDqb6r$`|TExfR;Oi~1SV*tVrJM~8#O-7P1_cenf0bnq&Qi-ZdJPz zI18l1`*Bo*t4p>kmN#aIYrHZFPsBawS3YvVE=F&O8Go0wN-rF+!+v>}z~`VeRt#=1 zc}7(l1BFM(PqPB!Mkhu5vDFHE6!*8a9|>sKk9rBg4?NhbFY>dZFh;O%$vZ!o?ThM@ z*t(@%a*fWqQyk}YrP}}3W!tibDlg65ySW_Cl*bu=-7qH*UnyTh`MYbZGuNVAAczXy zjKahDhJWN@WF^8ZIg%@Bv&p=Va-!~`A2+7=ncxH@d$I&GIOVzA62Rlzo8MKp$yO^b z%VJ4SN$mgCu1rH4+rqB1|8TY+E%b4kNL>eNv-lya4i{96Zo_}7AKTjstieG`5}6TP z37!mF`kl#`1P4UnOS-#u!x`0FtYmDnXid-4vwr}}hf(puEJ6e+;v#K1vg{&zSn1+H zoft$Nol3-F5R+TGo3|`je2zc?FM{*K=Kn(j_9FPD6nYQ zg!s&2ZmS>ep)4zI7M!=c-aF|3Mlxj_S{Q=Xq@^?@1;o^PJ6ZLi4jH-~{h9ycUqDcl z41YsR5dH9N?hPafnY6Dm)NDSK&5~bW_lfN&R27SGk&L&|l&jeC)NMy%`4SZ<$7MD7>%DDbs4acGP!;t6J`56F*JLfQQ zXa+-9$1Z29_iY`+o9mv(Yc7q+Ge5pC(0>jh>5;v!e^7R7Yti{2f+y*Y~?FeFUV&8kB*NW0PTL&a0cMDFN2e$D zO^4r_qWbjl+nJ(({F_HKyS@+!T&6D5XM-^eoh4->95B{hT2~p?ha)IVvMAzD?tlKi zTSr-k7M@~z*767}{?odi)+7>;#`t3ScWVj)soHQg^=6czUXCwuPHiS(O4H>5B}R_G zj+L;DiQ!Lc;A`qCrHqp<9zD3}_A%~2#Lns_mofiZPtj%?H;w#+%2CArd=f3i-gv)~ zcv>NgL#stJYdgejv0%nNF=sv^kbi9T4b;PTPou}|YWRbL8}nxKR{M#79v9ig4NA#c zK+agEu9bO^Fyv(koI)A0@r6DSRhNc%qQ@GG?YOivx<5ooVU1zJhhGQ4(rIYGLL^{G zG(k{F$7W)sy-R~Fm4UVmd4&ajy&TM>j2)Yc>^A+>K*HumI!XQ zJUxYiY=uM? z&NK)PY(xp4H2#idJRDo2K1U7P>)K$j0_-o0#l==`JYmqNgeo7G)dhPQ)nM%aH@JW9 zo}lI;t$1rNh#zC07QX}^5PwNPf_?xrysEBwmnG8tAad^>9c*VW?$p6 z?B4Dl={K}VBac0ea=M=pra*+_L=*As9pCai{g4VPRC|@?-i_C!<4Mg=4_jfdLJ7NU zBs1B+`zzEvVsunVsUilRu-hafHO|T^s@#LeHpy zFuuua!f?wDIVgFeDt`#MeSw=V_S{UORFnNQ z)>zoO%Ovf><-h4zC5aFDeH&VAflDcg&4(bGp9x>p{M4V8RkhQ>D2_2k>Xw;-4g&bPY3&epL1&alcAb)T)Z7@kEVslDiK?*G` zEg)%aFjGuXFJnP+b1+D6W-mp0ab{_5Ms;UUNo`A0STcB2WPdV2LUK|@X;liqp51yh zp_wsX=I)VPcts%i5j??1(S;U4oF%Z8v^CUyB=bp?QngSfIIK@i28mCmq+NMjW2s&= z>-x=_9~!N1j-L)EzD9od&etn0X`Ot0pU=sCG&UJ&=N^Ow8r{G6?Q@2p3Mf3ch}bGq zJdRATiG;^v3V+0-TEpjkK(E5Sx3Jh`D?01A;Mw(u#CwM}Myx$j8iz<4^Ksm*zJ@s2 zpJ1RW;N$bwh9I(^sS7o@lO{C!E>?WI~yp z=JXH*Z$`X*9yl@(m_}cfSoLSxzuHV-NVCV6FueWa4K^9Zq3I>?E3-0s{Woz|6f8^i zGDO$U?}&MmSww+~LZU=+)Xl>L0CL1&alcAb&$>VK7TeFGMdT%w%a^Di{g`|q>fa~w ze3i<0u=ImOJqajJ(J%G?xn*njVu$f+yBsrR9&BEE(-z*dEq@#7nS=`OZ&qQYwD;^T zLBB^%4y1rlntw(K4Ye=TJoK7p8~bp;1M>2(7)TA_dzErE6}c#E_q7R+f+#clsh@ee zlig%(hcu>2dA4_`bMa6A=S?DA`V&o$_m)k03lSeAL@ zNR?Sl9^c_Z7z-l5bSGSrVrNdY0%Zl};^cA_=4kEykbjG}SzBhb%KXG>P*?O3Tcs32 zF6ihSeDqQ@1g~BN^v8rMEM-5KyVIyGIOZ_^&${JctSSG_Ml!~BT&57>Nx-Tz#wLdz zN4fH_A&Bi{SbH<_Q-3LSL|YT4!^0w@X}QstCR->lpOF~+SYtMp=X_9trS|iy=;D#n zqL#MRAaB+*@uir8N_?F*LdjyvfSZgX<(UV92}lgYV!=iO_if%E^=l-F;a}AYm3HBk z(&4u*u`=<`LpOOx-pHBVqO=18rpbg9D0kEo)#Is0+>W+7AhtrbQ&>2~jI)Syc-lKE Qq*n;IA6QLi87xPrz}!M4`v3p{ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age index b8486ae4194007836a947a022d9ad842f0b417e0..0d431a2e68db4890ba3dec16fda91e5a961842a0 100644 GIT binary patch delta 1126 zcmV-s1eyEy2=@q(Ab)E%Z)-++FL*FdLwI>)R5V06G)hWMIdo`rOf_y!Wio3)Zsn7=UlasYZqL(S!$x}oZ=zr`J8Dm87tTDJ}JMtUQ z2Ic6utep5-gEn^h#4}*!v=Hsx(>q_NC4|s(%SAfa^!-f7j^hn?-i#ii8%J zVFjL$R(mYvDJ(a0lfa3$V+&f1!w(j=vr{eu|Oy zWaoe}v4kp(L4g-=$!&IRau;HN-;MD7$9XAGW;dj?{v@CqbxNSv z5%IO?ilXl?o;~y*YrN?bUnesDnY}KoL4V>6>MH~ZEK$6buPN@O&*G^t7K_LVnYmjR zo_l)JAb&HNC=?EhmOMbk!(y8*)`H>|!ntWl*anA=)S&oZcUs5Wo4%f?1?AXyAu>vS zi7HvlR1}&DqNXn-RF0dT?c2t1-yB;g2W_pYUh}Sp&hP8noB2RU14TA$mbObj(>)}w zy~7RGQRJfBa|^@yCs%~bI&Fj;kgmKWBoPpIT7QQeq|c;zn6f%&q@Zjp*hJq|%9$WQ zzI&ruRa^KBjW=p2(leBqKdjO-t0*ra0BUlC>trPWq<2NI)wPa^G_vi`a4`gO&&yU# zef#6_dqCNchV*!Y%g2O#)s3B^8KxmTWZ!WV4)Lf2qrue{&$YR-J5QtL|9ZvRY8CmQ znSae&>8a*9W%Nk02bSF?C3bz-HgKtR;M{KFs^S802_`OCUMhBb0_dCE8qh6yJX37Kul-N%N8Jf;4Rt znd{9FF-)}#!jPZ9@IcbKiaNRgmyVAwg?|J}Vq`Mch`4g~f!7L~&loR#;{RpH{u78;3ZS&z?w0as`AnCYS_teW{Z~#icrr`gaPAT(FZY!fYQTs)L)jw z0{mW!GP!O;K6LxHOiG?U-eLxbuCXR-T(jq delta 1126 zcmV-s1eyEy2=@q(Ab(|WMr}7WPE>YMQCBZwPcm#Xb!|swQA=+}S42r?SWRnja!YS3 zL_%*cZwf1UG&OTKFlTaNaCl@gF-B8wPEJ-!Vs9`oL{v*lN?J#0Mr%w-XhUx?RSGRF zEg(WpX)|X_VsL9=Swk{1P)}50NPlH%X?js;aY+i^@r=7c z82AFXlgJFiaWlA%SsT$q#?8lr^ZZFF09N&kRV^Z=77b+TjBW&(Wgn*PN(O=U^lW)` z^l}ID^+A)6z6Gx!-fyK$S@U!1U3D>qsvm1>IwHEGc`(3w*jlT}%clxg6<{`OK$ZXH zP`ixmON_m+*?&a99Tpcz*9CHK&YP|(J%T*#w!h&c;P4oh~OMP%ZwogvTWs)i) zcg{`j1<~7C`4o29?CPiNiIL}-nUe*W-W@xSuFykS1moj_Cx*UStu^?ECle_|!b=sy z3{7XBY&K}V$4PU54VL|fv5MoeBEeL4I0sFb?NRO6Cx61hs)<*I$t>L&jH+X0w4&w5 zKy4@cJQo*C!gZfWr(uOc=h?4yVu4CAUWE7yCC}SDO1Q#9bl4Vb`3(!Xu7_zCG;&_* zFE>VIy}*8TXk+(fcNp{4-GXq6=g%tdVjMvc z4#qKy%%75dvT2U|8hb85Ise|vxg%dxq(BZVxYCIfD!O6mXze@IjO02KS?P!fx~Z;bVSo459{>3#JmD;m_^7y{PP z0m;~7ie!^K^KQFf839Y^D~>h4C2Q$r&SIXheN@HIm28j@WBRm!vMl-Cct>f7=w*97 zpv-VfjO#qIevWeU5pojb%N+#ica=ih1ANv|I77zix)N1yTRbwGIkK$>-3L?F&tFYm z=YNq!8jVj#=L?YzqyLm>Uf2_mAR~HMIBDl1s@4Rz+TqVfnv~TKW=Z83y3c}RJ6(p} st(wO&!LUUl*e$iEA?=!0sm6s_)H=^X2e%^Ag>+d9I(8+^l$LRFU-~^4HUIzs