coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ADHOC-2026-11-06: user-engine literal tokens checked; none is a live credential; two owner findings routed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 06:10:46 +01:00
parent d51eda4685
commit 9015849e01
2 changed files with 51 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -15,6 +15,7 @@
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
| workplan | NK-WP-ADHOC-2026-11-06 | finished | — | workplans/ADHOC-2026-11-06.md |
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| workplan | NK-WP-0011 | blocked | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
@ -72,6 +73,7 @@
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
| task | NK-WP-ADHOC-2026-11-06-T01 | done | — | workplans/ADHOC-2026-11-06.md |
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |

49
workplans/ADHOC-2026-11-06.md Normal file
View file

@ -0,0 +1,49 @@
---
id: NK-WP-ADHOC-2026-11-06
type: workplan
title: "Check literal token values in the user-engine manifests"
domain: infotech
repo: net-kingdom
status: finished
owner: claude
created: "2026-11-06"
updated: "2026-11-06"
flavor: implementation
---
## Check literal token values in the user-engine manifests
```task
id: NK-WP-ADHOC-2026-11-06-T01
status: done
priority: medium
```
Found during NK-WP-0058-T05: three token- or password-named env vars carry literal values in
`sso-mfa/k8s/user-engine/`, outside the `sso` namespace. The founder asked whether they are real credentials that
need rotating.
**Method:** values masked in every printout. Occurrences were counted across all checked-out repositories through a
pattern file, never a command line. Then the history of each line, and whether any service verifies the value.
**One slip:** the first occurrence search timed out, and its error message printed the first value. That value is
the descriptive string for the harness ingest token below, a placeholder, so nothing secret was exposed. The other
searches used a pattern file.
| Variable | Where | Finding | Rotation |
| --- | --- | --- | --- |
| `EMAIL_CONNECT_INGEST_TOKEN` | `registration-acceptance-harness.yaml`, namespace `email-connect` (test double, added `94f27cb` "Complete live registration acceptance") | descriptive placeholder string, 21 characters, for the acceptance harness's own mail capture | not needed |
| `EMAIL_CONNECT_SMTP_PASSWORD` | same harness, next to a local SMTP host | a common 7-letter lowercase word that occurs in over 2,300 files across the repositories | not needed |
| `USER_ENGINE_TENANT_MANAGEMENT_TOKEN` | `runtime.yaml` here (added `62b1ea3`, 2026-08-09) and the deployed rapp-user-engine `manifests/runtime.yaml` (since its bootstrap `84929d8`) | 25 characters of dash-separated lowercase words. user-engine sends it as a bearer on `POST /v1/tenants` to `tenant-engine:8090`. tenant-engine has never had that route, never verified a bearer (no history of either in its repo), and its August deployment had no token setting. **Nothing accepts it, so it grants nothing** | not needed |
**Two findings remain, for the owners:**
1. **A literal "bearer token" in a deployed manifest.** It is harmless only as long as no service checks it. If
tenant-engine, or a future tenant authority, ever accepts a static token, this weak string would become a
credential. It should be delivered by `valueFrom` like `USER_ENGINE_PROVISIONING_TOKEN`, or removed while unused.
Owner: rapp-user-engine; the net-kingdom copy is a reference (migration input, SCOPE).
2. **Portal tenant creation cannot work as configured.** user-engine calls `POST /v1/tenants`, while tenant-engine
serves `POST /tenants` and authorizes with flex-auth and the payload's actor, not a bearer. Owners: user-engine
and tenant-engine.
Both were sent to the owners as hub messages: user-engine `f441911e`, tenant-engine `700c43f1`.