From 95d39916f1a767d0409739ccce22aeaf482c0628 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 28 Oct 2026 09:11:58 +0100 Subject: [PATCH] NK-WP-0053-T04: drill covers Authelia and by-user MFA, operated by admin Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56 --- docs/identity-restore-drill.md | 14 +++++++++++--- .../NK-WP-0053-identity-restore-drill-cadence.md | 5 +++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/docs/identity-restore-drill.md b/docs/identity-restore-drill.md index 0cb4142..80767f4 100644 --- a/docs/identity-restore-drill.md +++ b/docs/identity-restore-drill.md @@ -18,9 +18,16 @@ backup age key and the Backup-account credential through Platform custody. | 1. Independent retrieval | `tools/bootstrap-recovery/retrieve-identity.py --source-receipt --receipt ` ([ceremony](bootstrap-recovery-ceremony.md) step 5) | The newest successful generation re-downloads and binds by ETag/size/hash | | 2. LLDAP | `tools/bootstrap-recovery/run-isolated-lldap.sh ` | Directory restore and authentication in isolation | | 3. privacyIDEA | `tools/bootstrap-recovery/run-isolated-privacyidea.sh ` | Database, token-material decryption and audit signatures in isolation | +| 4. Authelia | `tools/bootstrap-recovery/run-isolated-authelia.sh admin ` | Authelia restored against the restored directory accepts the existing user `admin` in isolation | +| 5. By-user MFA | `tools/bootstrap-recovery/run-isolated-privacyidea-mfa.sh `, login `admin` | `admin`'s retained OTP token from the backup validates a fresh code in isolation | + +Every stage is run by `admin`, the operator of record and the MFA test subject; +`platform-root` is kept for break-glass. Stage 5 needs a generation captured after +2026-10-25 03:45 UTC, the first daily capture holding `admin`'s OTP token; an older +generation proves nothing for `admin`. Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted -attempt), retained-factor MFA (T19), any production restore or cutover, and +attempt), any production restore or cutover, and `run-offline-recovery.sh` (it publishes kit files, which is a production effect). @@ -47,8 +54,9 @@ receipt by hand. Keep the value-safe receipts under `docs/evidence/-identity-restore-drill/`: `transfer.json` (public fields only), `lldap-recovery.json`, -`privacyidea-recovery.json` and a short `drill.json` with the date, generation, -operator role, verdict and next due date. Before committing, run the repository +`privacyidea-recovery.json`, `authelia-recovery.json`, `privacyidea-mfa-recovery.json` +and a short `drill.json` with the date, generation, verdict, next due date and, per +stage, the identity that ran it and the login it tested. Before committing, run the repository secret scan (the pre-commit hook does this). No key, password, token or plaintext may enter Git, State Hub or chat. diff --git a/workplans/NK-WP-0053-identity-restore-drill-cadence.md b/workplans/NK-WP-0053-identity-restore-drill-cadence.md index 2f6995c..bef8434 100644 --- a/workplans/NK-WP-0053-identity-restore-drill-cadence.md +++ b/workplans/NK-WP-0053-identity-restore-drill-cadence.md @@ -101,6 +101,11 @@ after that capture; an older generation holds no token for `admin` and proves no `admin`-operated MFA run has passed on a post-enrolment generation, and its evidence names the identity used. +**2026-10-28:** the drill document now lists all five stages (Authelia and by-user MFA added, +retained-factor MFA no longer out of scope) with `admin` as operator, and the evidence records +the identity and login per stage. Remaining: the first `admin`-operated MFA run on a +post-2026-10-25 generation. + ## Review the G1 residual-risk acceptance ```task