coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: retire unsafe legacy LDAP lifecycle callers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-14 00:08:42 +02:00
parent 276b95f6ba
commit 84c5dbeec8
21 changed files with 390 additions and 1023 deletions
Download patch file Download diff file Expand all files Collapse all files

56
docs/smooth-bootstrap-guide.md
View file

@ -12,7 +12,7 @@ See also:
- docs/NetkingdomRuntimeArchitecture.md (T02 – what exists)
- docs/security-bootstrap-retrospective.md (T03 – what was bumpy, now automated, gaps)
- tools/security-bootstrap-console/security_bootstrap_console.py + make security-bootstrap-* (control surface, evidence, validators)
- sso-mfa/k8s/lldap/dry-run-nonroot-user.sh + related (0019 polish)
- [Current lifecycle owner routes](legacy-lldap-lifecycle-retirement.md); the 0019 scripts are retired.
- .local/security-bootstrap.json + console status (current gates)
**Pragmatic note (per 0018 Coordination):** Track your progress through this guide using State Hub /progress/ (with workstream/task), dated notes in NET-WP-0018 workplan, git, console evidence/validators, /tmp evidence. This feeds future retrospectives.
@ -25,7 +25,7 @@ From platform architecture and UX contracts:
- **UI posture (console/web):** Calm field notebook; black/white + hi accents; panels; sentence case; no hype. Shows effective access before any save/action. Blocked conditions explicit (e.g., no platform-root for non-king, MFA required for privileged).
- **Evidence discipline:** All steps produce/require non-secret evidence.json or metadata flags matching exact templates/validators (no secret markers). 12+ bools for user lifecycle (effective preview, no root grant, actor checks, verified identity/claims, reversible, no secrets recorded, etc.).
- **Actor classes & previews:** Always distinguish (setup operator, platform admin, tenant admin, reviewer, king). Show effective privileges before create/save. Never grant platform-root except via explicit king path.
- **Secret boundary:** Console/UI never collects/stores secrets. Use password-safe, k8s secrets, or operator memory. Prefer k8s fallback for dry-runs (see 0019).
- **Secret boundary:** Console/UI never collects/stores secrets. Use password-safe, k8s secrets, or operator memory. Use the existing governed credential-delivery path; legacy automatic admin-secret extraction is withdrawn.
- **Reversible where possible; human custody gates explicit.**
- **Handoff to production readiness:** After S6, move to 0017 production items (audit durability, etc. – not duplicated here).
@ -37,7 +37,7 @@ From platform architecture and UX contracts:
5. KeyCape deployment + client registration + OIDC.
6. OpenBao init/unseal/config (OIDC admin binding via KeyCape).
7. Token cleanup, root disposition, restore drill, escrow/custody.
8. User lifecycle (onboard/lock/offboard/review – use 0019 dry-run for tests).
8. User lifecycle (onboard/lock/offboard/review through the current User Engine and IAM owner contracts).
9. State Hub sync, audit posture, cleanup/rotation.
10. Platform reopen (S6) + handoff.
@ -77,18 +77,18 @@ See T03 retrospective for past realm drift bumps (now partially automated via ru
## Step 3: LLDAP / Bootstrap User Creation (platform-root / king)
- Create platform-root user in LLDAP (via create-user.sh or LLDAP admin UI at lldap.coulomb.social).
- Command example (with KUBECTL fallback): `cd sso-mfa/k8s/lldap && ./create-user.sh platform-root ...` (no --admin for non-root tests; use --admin only for platform admins via king path).
- Establish or recover platform-root only through the exact owner-reviewed IAM bootstrap/recovery ceremony; ordinary public registration cannot grant platform-root.
- The legacy account-creation and break-glass scripts are retired; see [recovery limits](legacy-lldap-lifecycle-retirement.md). Preserve existing account/password custody pending owner verification.
- Self-enroll TOTP in privacyIDEA.
- Verify MFA state: `bash sso-mfa/k8s/privacyidea/check-user-mfa-state.sh platform-root --token-file /absolute/private/diagnostic.jwt` after owner-admitted protected input. See the [diagnostic contract](../sso-mfa/k8s/privacyidea/README.md#scoped-factor-state-diagnostic); the KeyCape workload credential is not a general diagnostic delivery lane. Counts do not verify user existence or an MFA login.
- Verify OIDC/KeyCape path: `cd ../keycape && ./verify-openbao-client.sh`.
- Groups: net-kingdom-admins for platform-root.
- Evidence: identity_account_created, identity_group_confirmed, mfa_*, oidc_login_verified.
- For non-root tests: use 0019 dry-run (see Step 8).
- For non-root trials: follow Step 7 with exact owner scope and actual consumer evidence.
**Blocked if:** Actor requests net-kingdom-admins without king path; no MFA for privileged.
**Console:** `lifecycle-guide` for full flow; `onboarding-dry-run*` for tests.
**Console:** `lifecycle-guide` for current owner routes. Legacy execution and inferred-claims commands exit with failure.
## Step 4: KeyCape Deployment + Client Registration + OIDC
@ -160,34 +160,24 @@ See T02 for secret/credential path details; T03 for past claim shape / token iss
See T03 for operator-state / token bumps (now in metadata + validators).
## Step 7: User Lifecycle (Onboard / Lock / Offboard / Review) – Use 0019 Polish
## Step 7: User lifecycle through its owners
This implements the first practical flow per docs/security-bootstrap-user-lifecycle.md (UX contract) + T02/ T03.
Follow [the current lifecycle routes and retirement notice](legacy-lldap-lifecycle-retirement.md).
User Engine owns ordinary onboarding, account lifecycle and product memberships;
the existing identity-provisioner and IAM provider own identity and password setup.
Use only admitted clients/tenants. Platform-root bootstrap has a separate owner
ceremony and cannot be performed through public registration.
**Always:**
- Preview effective access (actor_class, scope, groups, MFA, OpenBao policy, no root for non-king).
- Record non-secret evidence/audit (State Hub /progress/, console evidence, k8s audit).
- MFA required for privileged.
- Reversible where possible.
Preview the intended scope, obtain the existing authorization, and retain actual
identity/claims/access, denial and exact cleanup receipts. A group list cannot
verify issued claims or prove all sessions revoked. Never delete test accounts
by a name pattern. Preserve other tenants and global identity state.
**Detailed (from console lifecycle-guide + 0019):**
- Onboard scoped non-root: use `make security-bootstrap-onboarding-dry-run SUBJECT=... EMAIL=... DISPLAY="..."` (or direct ./dry-run-nonroot-user.sh). Internally: safe secret (k8s/env /tmp), create --test (no --admin), verify MFA/KeyCape, optional lock/offboard GraphQL, populate/validate evidence (lldap_identity_verified, keycape_oidc_claims_verified, effective_access_summary, lock_offboard_result, actor_class="user", groups=["net-kingdom-users"], no_secret_material_recorded, prevents_platform_root_grant, etc.).
- Console: `onboarding-dry-run`, `onboarding-dry-run-claims` (infers claims from groups + T01 role; warns on admins/root), `lifecycle-cleanup-dryrun-users --pattern t06-*`.
- Lock: remove from groups (GraphQL or LLDAP UI); reversible.
- Offboard: delete user after resource transfer + reason/date; evidence.
- Review: check-user-mfa-state, LLDAP groups, owned principals; rotate via creds tools.
- Fabric/tenant admin: same but scoped groups, no platform-root, explicit preview "will NOT be in net-kingdom-admins".
- For platform-root/king: king path only.
**Evidence templates:** `make security-bootstrap-onboarding-dry-run-template`, `lifecycle-flow-template`.
**Validate:** `make security-bootstrap-validate-onboarding-dry-run`, `validate-lifecycle-flow`.
**Runbook:** "User lifecycle dry-run (T06)" in console runbooks (refs 0019 + script).
**Blocked if:** Missing actor/scope, privileged without MFA, ordinary user gets root groups/policy.
See 0019 workplan + dry-run script + T03 matrix for past taint/hygiene bumps (now largely automated via /tmp + evidence).
Update console lifecycle_guide T06 section if it still shows old manual secret steps (prefer orchestrator).
`lifecycle-flow-template` and `onboarding-dry-run-template` are blank evidence
worksheets. Their validators check structure; passing is not native acceptance.
The old Make/console execution commands and “User lifecycle dry-run (T06)” runbook
are retired. Group administration and independent recovery remain open in
NK-WP-0049; do not infer readiness from the earlier 0019 receipts.
## Step 8: Platform Reopen + Handoff
@ -203,7 +193,7 @@ Update console lifecycle_guide T06 section if it still shows old manual secret s
- Use T03 retrospective + T02 arch + this guide for future drills.
- Address gaps (UE adapters per assessment, full Audit Core correlation, more T08 validators).
- Rehearse rebuild per T09 (T09 complete; see docs/security-bootstrap-rebuild-risk-and-rehearsal.md for risk classification + non-destructive scripted/ns/parallel plan using 0019+creds+T08 validators; scripted/namespace first; use 0019 dry-run as model).
- Rehearse rebuild per T09 (T09 complete; see docs/security-bootstrap-rebuild-risk-and-rehearsal.md for risk classification + non-destructive scripted/ns/parallel plan using 0019+creds+T08 validators; scripted/namespace first; use current owner lifecycle contracts and exact trial provenance).
## Evidence Summary Table (Core Non-Secret)