From 9015849e017185646801f52206fc92eef15ceba9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 6 Nov 2026 06:10:46 +0100 Subject: [PATCH] ADHOC-2026-11-06: user-engine literal tokens checked; none is a live credential; two owner findings routed Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0 --- WORK-RECORDS.md | 2 ++ workplans/ADHOC-2026-11-06.md | 49 +++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 workplans/ADHOC-2026-11-06.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index c4c6c74..736e1d4 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -15,6 +15,7 @@ | workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | | workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | | workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | +| workplan | NK-WP-ADHOC-2026-11-06 | finished | — | workplans/ADHOC-2026-11-06.md | | workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | | workplan | NK-WP-0011 | blocked | — | workplans/NK-WP-0011-enterprise-federation-saml.md | @@ -72,6 +73,7 @@ | task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | | task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | | task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md | +| task | NK-WP-ADHOC-2026-11-06-T01 | done | — | workplans/ADHOC-2026-11-06.md | | task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | diff --git a/workplans/ADHOC-2026-11-06.md b/workplans/ADHOC-2026-11-06.md new file mode 100644 index 0000000..65b7c3f --- /dev/null +++ b/workplans/ADHOC-2026-11-06.md @@ -0,0 +1,49 @@ +--- +id: NK-WP-ADHOC-2026-11-06 +type: workplan +title: "Check literal token values in the user-engine manifests" +domain: infotech +repo: net-kingdom +status: finished +owner: claude +created: "2026-11-06" +updated: "2026-11-06" +flavor: implementation +--- + +## Check literal token values in the user-engine manifests + +```task +id: NK-WP-ADHOC-2026-11-06-T01 +status: done +priority: medium +``` + +Found during NK-WP-0058-T05: three token- or password-named env vars carry literal values in +`sso-mfa/k8s/user-engine/`, outside the `sso` namespace. The founder asked whether they are real credentials that +need rotating. + +**Method:** values masked in every printout. Occurrences were counted across all checked-out repositories through a +pattern file, never a command line. Then the history of each line, and whether any service verifies the value. + +**One slip:** the first occurrence search timed out, and its error message printed the first value. That value is +the descriptive string for the harness ingest token below, a placeholder, so nothing secret was exposed. The other +searches used a pattern file. + +| Variable | Where | Finding | Rotation | +| --- | --- | --- | --- | +| `EMAIL_CONNECT_INGEST_TOKEN` | `registration-acceptance-harness.yaml`, namespace `email-connect` (test double, added `94f27cb` "Complete live registration acceptance") | descriptive placeholder string, 21 characters, for the acceptance harness's own mail capture | not needed | +| `EMAIL_CONNECT_SMTP_PASSWORD` | same harness, next to a local SMTP host | a common 7-letter lowercase word that occurs in over 2,300 files across the repositories | not needed | +| `USER_ENGINE_TENANT_MANAGEMENT_TOKEN` | `runtime.yaml` here (added `62b1ea3`, 2026-08-09) and the deployed rapp-user-engine `manifests/runtime.yaml` (since its bootstrap `84929d8`) | 25 characters of dash-separated lowercase words. user-engine sends it as a bearer on `POST /v1/tenants` to `tenant-engine:8090`. tenant-engine has never had that route, never verified a bearer (no history of either in its repo), and its August deployment had no token setting. **Nothing accepts it, so it grants nothing** | not needed | + +**Two findings remain, for the owners:** + +1. **A literal "bearer token" in a deployed manifest.** It is harmless only as long as no service checks it. If + tenant-engine, or a future tenant authority, ever accepts a static token, this weak string would become a + credential. It should be delivered by `valueFrom` like `USER_ENGINE_PROVISIONING_TOKEN`, or removed while unused. + Owner: rapp-user-engine; the net-kingdom copy is a reference (migration input, SCOPE). +2. **Portal tenant creation cannot work as configured.** user-engine calls `POST /v1/tenants`, while tenant-engine + serves `POST /tenants` and authorizes with flex-auth and the payload's actor, not a bearer. Owners: user-engine + and tenant-engine. + +Both were sent to the owners as hub messages: user-engine `f441911e`, tenant-engine `700c43f1`.