coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native reset authority rehearsal and remaining admission scope
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
tegwick 2026-10-31 13:40:07 +01:00
parent 661ab6a52e
commit a192c9abfc
3 changed files with 312 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

265
docs/evidence/2026-10-31-reset-authority/native-matrix.json Normal file
View file

@ -0,0 +1,265 @@
{
"schema": "coulomb.native-reset-authority-matrix.v1",
"observed_at": "2026-10-31T12:37:24.533367+00:00",
"data": "synthetic",
"status": "native_authority_matrix_verified",
"images": {
"lldap": "sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d",
"authelia": "sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54",
"client": "sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd"
},
"production_access": false,
"provider_smtp_contacted": false,
"owner_runtime_or_permission_change_performed": false,
"no_ports_host_mounts_or_external_routes": true,
"backend_container_flags_verified_before_fixture_import": true,
"source_manifest_sha256": "c982e3a47d9e3aec5095a3c11fea7260fd4f5cb6db57b827b915988b432a18d0",
"target_classes": {
"alice": "ordinary user",
"bob": "other ordinary user",
"operator": "lldap_admin member",
"appoperator": "application-admins member, not lldap_admin",
"svc-other": "other service, lldap_strict_readonly"
},
"findings": {
"scenarios": [
{
"bind_role": "lldap_strict_readonly",
"directory_writes": {
"positive_controls": 7,
"refused_mutations": [
"create_user",
"edit_other_user",
"delete_user",
"create_group",
"delete_group",
"self_promote_admin",
"remove_admin_membership"
],
"directory_metadata_unchanged": true
},
"direct_password_changes": [
{
"target": "alice",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
},
{
"target": "bob",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
},
{
"target": "operator",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
},
{
"target": "appoperator",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
},
{
"target": "svc-other",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
}
],
"authelia_resets": [
{
"target": "alice",
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
},
{
"target": "bob",
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
},
{
"target": "operator",
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
},
{
"target": "appoperator",
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
}
]
},
{
"bind_role": "lldap_password_manager",
"directory_writes": {
"positive_controls": 7,
"refused_mutations": [
"create_user",
"edit_other_user",
"delete_user",
"create_group",
"delete_group",
"self_promote_admin",
"remove_admin_membership"
],
"directory_metadata_unchanged": true
},
"direct_password_changes": [
{
"target": "alice",
"password_changed": true,
"old_password_accepted": false,
"new_password_accepted": true
},
{
"target": "bob",
"password_changed": true,
"old_password_accepted": false,
"new_password_accepted": true
},
{
"target": "operator",
"password_changed": false,
"old_password_accepted": true,
"new_password_accepted": false
},
{
"target": "appoperator",
"password_changed": true,
"old_password_accepted": false,
"new_password_accepted": true
},
{
"target": "svc-other",
"password_changed": true,
"old_password_accepted": false,
"new_password_accepted": true
}
],
"authelia_resets": [
{
"target": "alice",
"status": "reset_completed",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": null,
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": false,
"new_password_accepted_after": true
},
{
"target": "bob",
"status": "reset_completed",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": null,
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": false,
"new_password_accepted_after": true
},
{
"target": "operator",
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
},
{
"target": "appoperator",
"status": "reset_completed",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": null,
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": false,
"new_password_accepted_after": true
}
]
}
],
"cleanup_verified": true
}
}