coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0053-T04: drill covers Authelia and by-user MFA, operated by admin

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 09:11:58 +01:00
parent 7384007256
commit 95d39916f1
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/identity-restore-drill.md
View file

@ -18,9 +18,16 @@ backup age key and the Backup-account credential through Platform custody.
| 1. Independent retrieval | `tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt>` ([ceremony](bootstrap-recovery-ceremony.md) step 5) | The newest successful generation re-downloads and binds by ETag/size/hash |
| 2. LLDAP | `tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt>` | Directory restore and authentication in isolation |
| 3. privacyIDEA | `tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt>` | Database, token-material decryption and audit signatures in isolation |
| 4. Authelia | `tools/bootstrap-recovery/run-isolated-authelia.sh admin <transfer receipt>` | Authelia restored against the restored directory accepts the existing user `admin` in isolation |
| 5. By-user MFA | `tools/bootstrap-recovery/run-isolated-privacyidea-mfa.sh <transfer receipt>`, login `admin` | `admin`'s retained OTP token from the backup validates a fresh code in isolation |
Every stage is run by `admin`, the operator of record and the MFA test subject;
`platform-root` is kept for break-glass. Stage 5 needs a generation captured after
2026-10-25 03:45 UTC, the first daily capture holding `admin`'s OTP token; an older
generation proves nothing for `admin`.
Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
attempt), retained-factor MFA (T19), any production restore or cutover, and
attempt), any production restore or cutover, and
`run-offline-recovery.sh` (it publishes kit files, which is a production
effect).
@ -47,8 +54,9 @@ receipt by hand.
Keep the value-safe receipts under
`docs/evidence/<YYYY-MM-DD>-identity-restore-drill/`:
`transfer.json` (public fields only), `lldap-recovery.json`,
`privacyidea-recovery.json` and a short `drill.json` with the date, generation,
operator role, verdict and next due date. Before committing, run the repository
`privacyidea-recovery.json`, `authelia-recovery.json`, `privacyidea-mfa-recovery.json`
and a short `drill.json` with the date, generation, verdict, next due date and, per
stage, the identity that ran it and the login it tested. Before committing, run the repository
secret scan (the pre-commit hook does this). No key, password, token or
plaintext may enter Git, State Hub or chat.

5
workplans/NK-WP-0053-identity-restore-drill-cadence.md
View file

@ -101,6 +101,11 @@ after that capture; an older generation holds no token for `admin` and proves no
`admin`-operated MFA run has passed on a post-enrolment generation, and its evidence names
the identity used.
**2026-10-28:** the drill document now lists all five stages (Authelia and by-user MFA added,
retained-factor MFA no longer out of scope) with `admin` as operator, and the evidence records
the identity and login per stage. Remaining: the first `admin`-operated MFA run on a
post-2026-10-25 generation.
## Review the G1 residual-risk acceptance
```task