From a65673985cfc4ce68a81249080de3277f512bef8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 10:52:05 +0100 Subject: [PATCH] NK-WP-0056-T04: svc-keycape bind delivered from OpenBao; bindPW cleared from keycape-config Founder-run under CCR-2026-0054: setup, ESO apply, verify, rollout of KeyCape main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW, clear-password, restart, env-only verify; admin signed in with OTP before and after the clear. Custody re-sealed after setup. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- .../01-setup.json | 14 ++++++++++++ .../02-verify-env-and-config.json | 18 +++++++++++++++ .../03-clear-password.json | 1 + .../04-verify-env-only.json | 18 +++++++++++++++ .../README.md | 21 ++++++++++++++++++ .../secrets.enc/authelia/secrets.env.age | Bin 1531 -> 1531 bytes .../secrets.enc/breakglass/secrets.env.age | Bin 491 -> 491 bytes .../bootstrap/secrets.enc/keycape/key.pem.age | Bin 1904 -> 1904 bytes .../secrets.enc/keycape/pi_admin_token.age | Bin 4036 -> 4036 bytes .../secrets.enc/keycape/secrets.env.age | Bin 588 -> 588 bytes .../secrets.enc/lldap/secrets.env.age | Bin 1143 -> 1143 bytes .../secrets.enc/postgres/secrets.env.age | Bin 594 -> 594 bytes .../secrets.enc/privacyidea/pi.enc.age | Bin 296 -> 296 bytes .../secrets.enc/privacyidea/private.pem.age | Bin 1875 -> 1875 bytes .../secrets.enc/privacyidea/public.pem.age | Bin 651 -> 651 bytes .../secrets.enc/privacyidea/secrets.env.age | Bin 1143 -> 1143 bytes workplans/NK-WP-0056-bounded-executor-path.md | 7 ++++++ 17 files changed, 79 insertions(+) create mode 100644 docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json create mode 100644 docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json new file mode 100644 index 0000000..d2294f2 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json @@ -0,0 +1,14 @@ +{ + "action": "setup", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "coding_agents_denied": true, + "custody_equals_live": true, + "external_secret_apply_and_verify_pending": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "custody_and_reader_prepared", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json new file mode 100644 index 0000000..448ecb7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json new file mode 100644 index 0000000..e1af090 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json @@ -0,0 +1 @@ +{"after": {"resource_version": "83122244", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "before": {"resource_version": "82820316", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": true, "changed": true, "mode": "apply", "operation": "clear-password", "other_secret_data_unchanged": true, "prior_bind": "service", "restart_required": true, "schema": "netkingdom.keycape-directory-bind.v1", "target": "sso/keycape-config", "task": "NK-WP-0056-T04", "unrelated_config_bytes_preserved": true, "values_emitted": false} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json new file mode 100644 index 0000000..448ecb7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md new file mode 100644 index 0000000..8694906 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md @@ -0,0 +1,21 @@ +# NK-WP-0056-T04 — svc-keycape bind in platform custody (2026-10-31) + +Founder-run in the founder's terminal under railiance-platform CCR-2026-0054 (approved by +platform-owner and net-kingdom-owner, binding confirmed, `5d87acd`; sha256 `e255807f…b110`). KeyCape reads +the bind from `KEYCAPE_LLDAP_BIND_PW` since key-cape `e2b5fa1` (KEY-WP-0046; image `main-e2b5fa1`, +`sha256:9e082dca…6f8d`). All receipts are value-free. + +| Step | Result | Receipt | +| --- | --- | --- | +| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `keycape-config` binds `uid=svc-keycape`; custody equal to its `bindPW`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` | +| apply `sso-mfa/k8s/keycape/bind-eso.yaml` | dedicated Secret `keycape-lldap-bind` created by ESO (`creationPolicy: Owner`), Ready | operator output | +| verify (env and config) | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other bind paths and token create denied; KV equals the delivered Secret and the config `bindPW` | `02-verify-env-and-config.json` | +| apply `deployment.yaml` (image `main-e2b5fa1` + `KEYCAPE_LLDAP_BIND_PW`) | server dry-run, apply, rolled out; log reports `bindPW` redundant once (both sources equal); `admin` portal sign-in with OTP (aal2) | operator output | +| `directory-bind-rollout.py clear-password` (dry-run, attended apply on uid/resourceVersion) | `bindPW` emptied; bind stays `svc-keycape`; unrelated config bytes and other Secret data unchanged | `03-clear-password.json` | +| restart KeyCape, verify (env only) | rolled out; no redundancy warning; KV equals the delivered Secret; `admin` portal sign-in with OTP (aal2) | `04-verify-env-only.json` | + +`svc-keycape`'s bind password now lives only in OpenBao +(`platform/workloads/net-kingdom/directory-binds/svc-keycape`), the ESO Secret and the founder's custody copy +(fallback); `keycape-config` no longer holds it. Rotation: change the password in LLDAP, write the next KV +version with CAS, restart KeyCape. Rollback: `directory-bind-rollout.py --operation switch` restores +`bindPW` from custody; the previous image is `sha256:cdec9dd7…f010` (then remove the env). diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index 26b018e6833f1a1c587c6a06b8a159674895bdf6..4c5f910569d12a67ba6cd57d2a385da7d8ffafed 100644 GIT binary patch delta 1516 zcmVHOaVr^?vQ8GbmI8|_WS20*p zO>|XF3VAhWaavS#IdXMKLrqL^d24cVQ+0GxS$A`5PE2`YLupuaZFVy@cwu2M3N0-y zAVgYeHClLSZE{UxSWhuVcxyOUaYt5BI81g?dNyofOmJsWY=28)VnJkYGzvuyMY21q(ogifACjF`=sPJIh1hgybWcWuWu6|9 z-5j=CpeT3&9DjUG8$yw2y^s8r!%RA#)nRH#{E!p5dpXj7DXv%SwpM+N#y%0J? zG{g+aU569Oi(;Qf6^Xo71@urElOL}TS!I*;tcOl>J51Pq!+_2dPT^w*MIN8zWP~4i zhJqIxQGcRPB>qOiV0{nhEZw&IpjDalWlN9Ai7I|524?r3NSNN(V>w)(g&OxYV3q~t zzYxJ4K{u>zos*Wh!-Lni5NTG?@PWA`=i84_V_X3~sV(~o-<4%5^F6DRDI(7r>3;E{ zW-aU$PsP|pn_c{syjWgI*-h9)()6tJNY8q*W`E0j%uULy{0l$6^hmJgTq-hbS&ja% zTK-Lbko<6v)q2{lS|m4j8Pj_5em~kE%ddU7mtOVzN(GXWxG*m>ch*-NH^2Mjnm9Y; zDF9lw#{Ars<NL8xExRj#{;#y# z27FA8W6-`EKqaSTI=fH^8{fMzF@O2?oE5j28U2)RIT0nHpX|PWGSs17)&ao431ZvN zFtu=1`~An30`jwfZXOj|i@j9_jY9F)5wDPB{riQ|U>hRDw8~)aG@>!M)00vX19o%c zA)dTIi>C{P4?=>`S~|SW5fqR;G*`Um&_|*}(DA4W5otqaZMt!{JYa?k@P9)6VZR0j z8Y(ipbE-~terY7It>?bY9#UL}q~M2UHC$6W>(ec&9QkDXYfCAtSUv8?33C6jvwZRA zvv7J`*@+Pz;^tQG3jukRgRXSGbuR*vym@`jHvXY-81`$tx+f&PZ69jyum9?dk{82^ zG3Wydmp6mWGRiYa;v0-OV`a_x%M+*LBR5%AYPE`6MJv!&#>w-phvL2eVy((Ap*fq^ zQRW1(C)o`2BBBrFvsR^rN(F#PIvyykJqd z7dZ?G>|}gY_;8Vx!I8=h$OpR^)yW;aSuqyL!?y7T ze4MD(exGhTWmKnTd?<;6BtoHF?X$=hm0EY`nUK3Z#;j%UYUBHrmn}p4+(G18TWLWE zx@j=)Q)3yCPk%=MC|z&9TM2$`X6g7Bk`&Ywh2Ydy@OYjIycVJ>7KVS%d!2C*5oD^S z3arQnu@BB2x~2Q)Wrcpt0v$lImLYZid4GFrwol|KW(ay5$Gpcw{PdkrD5Q0AyZxix zeN?!G6`ey&?V^P1LS!b)p!{iJKv^`oc+p@WQK|q@EPsy-g1*x)-hbU4!=9%Pj(a3z zIgBkussa`VvJE5m)bkMgwQZjyJCrx~Ygu%vFu;g*zlpsJ99mFgEqvzrz0l8TYGcYs_3atZSrtFJvP9hw2wxGRMzK}~ zHOW3HuVL?R@l*9|+N*#H8Pb!#IPHI)q94Ry4a*p?`9#r72qbh+%w&%U5JFCT><>qJ2xg z?a#g|Q^UhOUNzN!tzApYWV=IB#*$qQ%YNSA@tA4zAnv0`R96iCUf!Sy0|7!%#^rZT zjWBI+I6iW&m7(r1bQZ;O352hEHqdMqa2?Si7>9RudTkTwK@Q%Hl^ceqhFv#NAxZAr z;eT0F(o1FROjUwQg!FV$g}=bfi1wZc{Kftc`lCMv?~l2_yl(vDg_h#@{is8*GDsHL zmJ@Hn2GjNCYU7~hv%%}}QE3L~Rhhj!Xrihwt!dysuG=I4NN!kMUVqnG=3pBSWHUYusU2>=Tj4_jH zls3VdXib5k_5@t+7Hv0FtO~ZSDWzhxUXQ*6;Oo$Iqr{VoG`yX;OHPqsIxBeN8l6~S zesJvCE(jO;kT*OyKouv*>7P&T(T>l|fej-7UagxRDHuW9#~@khRe#~U ze)etfCg8;`$(v}u)#_P7ym|B|8+h`f{})=@E$U3eU2~*mjmF9>?VW~c7rY1$JGjf@N5;+_$px!}DQ+CdOSdPT`qHZA$EZngs zl~f+rGv$D+6TaE8P5g#%+R$>3e}6wDgXw+<2s9es*ODiW!d3kW+B;cU*TGt6mJhA5 zLs8*zGcBt3EIz^9-uwp?0awZS_|UZ@(jx8lzz{K>d)_s|K{ z3Ai@J(LoKopB(e5nG+%uwV%w*Xrq-BC4h8Wk;oveyS5fT@}+=$n{Xh05P#Q&<3z~5 z-^KqvDN}yquI=yzag%@X=nge{?rg~&?xGut7N8Ej>NAQOwlz9dNV#h;k`@zDMh{$Q*)bC>2~*loiZX%7XvgnqgdMyIabO*3qe1g><@2sDy@BcuJ{ zbKh#b@eeG(U$jmRKq&MrC1towwp^=Dm_Hx+rky$WdP}bEf}WJ}5)msONnnIo^%K@9 zU)69v(io|Z=^)xMkQAdd3(;7iQIYD1kya*NQT8#=fHuNdaWSBbcs!6}G3)#tEWmsiPY(jZvZ9+#dGD%8OOnFgs za8hG=YYJ&-NkVc~N=I2jOf@uRa${L_HcfakO+#vJOIT`DbaqfdH&twEOEXSuFbXX# zEg(oYcu!_FdP-SJd2d=$FK0DcFGo*xL25NCMm1P*MlVHTaDP#Hc5pdoR9On5aguZs zTUzIhmH=h5NKpL=$|=qXeAPJTa2~ZSZK0NGDrYiQ?L?zr(}B}BNU;cU_WN%DMDB~2 zR&)Xy?oUj#d$nJM6cPCBpc#tHuwUFBEXjw?+^oC31c!7OnezWbnAy=@slZ7M^8p#y zPAl%%TB9+}dw*Rq;@}Vb?91Zf?c5RFMn+Q)cTp^E&>5-=>~s_78P|i1@Yn&4b}p?Z zG}l0GJ7qr3r)>``JgN|ZU)2}8z&L_e+#B#@s1#Y_(8^K_6ZgM**YkTtqFI!C7a^$8 zCAk`4O;9Y1&S9Klky)+_7#97$T+Q}Em3wl;MNq*W6HcquMx7%}&&BD_5&Tz$Vnhl* zU0|(!t&d%c_j#9-_?;$lNpghO%A`&6pd<1TY$MIj delta 469 zcmV;`0V@9M1M35jAb&4sM^#fYYdLr?OgA|&SWriLV`X-9VM0+vby7)9PH9wiV`@-G zV|OoYRSH8iWxFYH4z6bz*8bOn*sJOJ_-OVL=L`6K5 zX;9_xhv(qqCN&UsyospFu7+v9;+sr!a2baNSd(q~&)dV7_Qs!rP7oEHe!n1a|$gj zEg)7aGk0%zO)qnLP)uz%NMvJiI8SA7P%}AnM>$JrO-MO)Y=1>fNJ%tTS~LpTj%KIG z+}F4;gRV7UWy%@hPn-X!w|hK0s8xyGO9k#tQ|YK(IA6_mk~eWk<3Q#ksYd_vmtw||uS~{IuPD7;<>uIHL|YUhm^lurh!WN( z`K{#@8GCni1Ai<-;L>FWHxO(UUeM7oYr|e^_7!e>**oY1Tgu_5S#u_8(D}zm*&?Pj zd5+rG!>-G55>wV626KZ0&aZs6QkCnfBG zRwrb5fNHOFkc}N&A%DlQf7B&2oAw&hQHF-j6=ZD2w$^2=+K7*cc(W9 zA$r0TM1RL_gphf1u4LH0TqU%PpJ;GE~i>Tvug9^y3t| z8Qv>{5~M9Nth}wV52V-*K zX^>q(Mt=nfrzorR>Qa?&i4#(9d}~KVn{1X4z%=Nmvk00J=6X5Bg z8bB`k;gl{0^pmcxQ^|6=2b6%!N`WQTeoCfCJPGXh+yoKt=3AFfAs!~_HE*V0d($4% zv45&m^5IGVPbr|NAU5;_o!P)3uDb{ToOyII03@AC#FKD+9?+hlpDV7fv*jR;sMjhG zrhcZtqT4i;c;dt#xpkd8JHdLccDHm`2qgOPa^i74C|xsUgwBQviMHraA4p1Dm2oo) zpo&KSJRY1>;lpDh{n?iMEL4@R)jCyHL4T5lE%haKaxH2Xs1Y&oPBqDAmnY9-wP0Tl*T9D#ua5#&!6fRU|ga z(9^8nnSXdA1x@Aiz%6S6v@R@`lD3%6MNaqA9Kf(?|9|<^=;fxe7M`^F;!?Bj=zoH< zuOSM`!?(M2buHbP#{zd-{mx;(`C)T4`b4^N0c52H$KueMM&74gx;lFT_K0SiM;70+ zD36*uWUm+7sRGx$3^qx1c}Hw0?#bl(YyAx6G7v!n3a+{qkU09HUgCII!$Q2;a2u`5 zl&%}4rG-?Wou%-;rhu&cGw9#MIe!*m0Y#R%^`2RX5X>1aNDf?bL-G1M+FJJ2P1{GB zEqh`aUjYk1jzi2>V!5U!ASjNoIM;1GOaqhrFWp#=m552h;=hMZWtglhCt7EKb6q}o z{p(4uVeE#k4E1<;PhvP)iKPiJ^)3qzl=ml7sT;BYAE)f~sK{32s(GN?SbsgTb$c(7LfPX9My+@+~9Dn|Q=2f=>6Sb4`a2g%R$Ci@mnRhFr10u5$uFK@L2jwZ& z{zybyRpC8?fxJpPCj?cnb~NF%l#RM?6Zwfd)}UZK)Xt=Ofv zp1sPZzO(6bvq=Aw#%i4TbNOdj_GEC+wDM*AEImosCCVE~2xZH)_~sWlQqnt0v7c&4 zd-*l0)4?3XLOMl7fqyR3+js7tER=Os;BWh|g2P%mzgO2$plyXJph+2*ZV2tj@mgMP z-?j$tqwLRV68FfU+9vQI6W~v>5>mq+x(d)x`ATr$4-b466(+iXfO()MH< fz4^$wa9}li_Cr=XC=#}`qa1qbg{GF4j*s}Yx674+ delta 1893 zcmV-r2b%cs4)6|;Ab(JCc}r7JWNbuKb$De(WoR*KXGC#0c1=b~HEC5=S$b}HZBTMU zbar}rZwfhMXD~5JWG{9$L3d4XV{U3>GGaM#SawcTSZ#JTSxr$_Yfdy(b}}+;MG7q~ zEg)iYbW3ngHcePVZF6d4OIS}eM{+eYMMzahaB*REHFI_^Z+}&0RB&}{D@6(ua+qIq z#Lo4N0230w#Js}Nvbz1CRF)^0lt_iFM;{dSViN;Y*wf63pd%#g(y0hIujq0@PM7`zm@usDXxad_$!xZjK#i z2*I^uTYUT@3!XwMO2%owulYHLp8n70774T~O(RbSPCw%*ed@eig>f~<8Qp5tbElNP zjg1zp0T)qskyTU7R9yP^a#Y8%Z@iH^_mNyDt@D~)3V%-ukJ{}aM^#a)YsFvje2v1c z!NmI8&dP5fP1VV;%tTL(`m~tx>9H8qFyeb>eJg&?hFV<^j6z*24_6!{?P}<+^kbf# zD7xD|#tK&|VOdG_In$$}&l*4Y7>GK0)#iM~!)CA9pyc$TLI5H_xj>vgK|RZ|(r_Vd zzyd-I*MA?F8VIk(=~5bdEF6r_F=;9euY^<5w;l5GVq!W9qaZddM8AVt|9oF$Wxx=zd_8;y_1>#b?%w@!$a=ige!7CUVq-A zEB)H^1?4RXj&WK&_@*$zXT2_rlJ(RT0Z+M9Kw)4&f)4k9xqS`e><)}MI%WJlFMC$U z4{)uH$$M`<@Cr;cWU}f0qCpNfc)6%Nx4la8FF)mB3S%C+J&0^aZ3{KYm->$3jKHQ< zKcu}dwBX1H4$jXm$;!0-A}|fdKY#uN(T0M;)t55cUH#*d+l{p6LYCuBMhebyx4M4N zCV)N5vdu=gsG!*BlB9@%^rGmhryVdG&Uo&jzt5tkIx}mwG@Gk{<)c=*YH@Zw->z6~ z>JI0rGk9F9aT(5rIt!iH1!Csm@Ev(2{vnC|0h08YiS!`ZNUomKd-z7CWq)=#OaC%m zIIT$tnQ|xU`a=5xeMP0p#l|*K1nFHD3~|n_pUJ=q$b)PWSzhk=W|nlziAn~CpLa}P zBG~VN*cR>i1Q3S(v{^Gjqo8r5Ap}SelJ5+2O{F!s?y$wn!^)(`ni(==sdP_vSTrV& ziI@b|M7PBg@gvp0RuI6&$A7y`{JBf?xjI64*MY;ACH@D_B`%S&4{#OsP3!$+YbCQ- z76}e&Dr)4?;h7W2AxXPr+J7fhtVZO;k%x<3AMaf3bkfHbkKM%8LmKpwvubwOpWDkf z$AX|F({puzSS}7^x-jN`k6i5}vQ|soWLA{_CGzcA6``F}}xujE00k&x5PUQhQ4tnrtWr%72M?1wOko2T`Ii=(g=Od2W zpA;f!tkjZc^LFG7L|gT#ww|C+bFY3^d>K*RDC-Eh_|b>rYV$EP6F2&&8?$rMoa!K_ z^K;Gp0J#K{YNiBCwSP0698I}y!N-``C^q~KNX`B1q1Tet)i#Ahy2ap#&A!PZI_}r_ zEQIDw)&Vf?M{WjO-2iz<%v$$pdQb=>4J|`FxThnZM@D~qNfs^Hoth`0HL-#{^J_E| z{z}oVH@oRa&gED!*{E4K1UP@+G-60fAt$uBl`^xqpsoJaq+SkU|5*iF8R0?|b!Bk8 zQr3}yLD&oq@V%8Amr2om`p*qqfLo^=EXjKw25Q{=!byveef@ffT^GR*Y3sG4siA^g fLWSEQ!olda(78Ha7$=zPIO8zM>lwKI6+5d zabs7Y zNHchJVNy_dacpNVXL?6wX+a7^p>ar}3sK=RSC-qoAo`}T^M}|EO}I!uv(lFxAkI88 zC>6f=Y3Xfo%{JL9{#F4mB@lqDi6@;JQD{fo;WK7=sE9a_$2pexx@>;RInX6nkF@Cu zF9*zZqvt?R9tM|Z=SZp4WSlc|a(GfATk&1@y&<9XkNL77$r46W8}@vYF`Cv(JVho>FwEtIlsN>eE_5 z7n?MSHOX=Q}EV2R%pNO9_AwGdM zIJ5SNml54m-}==389aDZ_;)BZ19vlN*x?QuzC5NXDY{FZ9y|K3`pI{+g`iK2)Pnwo zGEf8kN{(oRUw=d!5UmI?&{m2+KTW;NQ+?PV;r%ZFr!l%$ zg)imMCe+&hKAPE(!8e(M*i)R7t7zl7p`P?Nfe+n}9f2Er3Y>bm(-^L(#@`#2VXG>! zCT27>Z)WU`IC@e8aGc$&J0_;K%+HZCv?7Z6-Qq0Dy z-fVnRZpzfebAL=Vv_(>C+s->sJGm`-{P9DptVf=S`*n}3%Fu${19dF^mGM@s32pDY zCZ8GnQjck}#+nJU%eW}KCAT?Z_e2Uhe?>;y*Hi>p2QYsUtbk)8&0Kv2;sY$v8#jJX zbRJKqk|=Hkw~=f96MFXD#T8BUC;Jh1P=P|IUAZAYsqI?OgyD6?{3dP7mMXVfh`4?D z3f{Rwr10n4tb{!oNvJSEn-AQ;ge&y2MXvE^KtO;CI~a*aBE1PAeg&rIuDA?67*h~GSy{gZ zmGkXL=e}G13!(m&bBbD%l0sXuFU+~aOd6YX-NX)W-9MT-($GcN_=^qeqFqfPcuL6R-Pm#gaSp|E%1*?)8_c zgM#S3Q0;!)Yxjgtjqo4K z-6fL_FxY(6MsY+W{iI_-{|>JCbjBlH*mF+z0qlhWu$Wkl0oT#pbwy4N?H5zYR0>22 zQt?;{vK!hL&5Pn&a!}r`*lN4%-elYGJ|xbqQ8hI+ifFM9+8XRAA8lo{21pSM3kpZn zfAvs~&_%*_2CqFbzj}0v&6HO&^AM3CeB?(yEDkoh{Yy28TEcMDL1$Z3|70G2cUKGx)`NL9Lv`;K*PJxpaD7EBp=s8 zsIAyE0f`cJK*CoK3$7&$hU)@xDu5!Vc$;LN(Bhs20NIc3I)QDEI3 zUDgn=Z{3XNj^$b~q4rq$biSzJo0kOz3^Sb0d|S#rG=&zg&X4R{`0V)6$%{&Th0XJ) zOm_8OGxaPY2J5>EgpG7BsD4%W&rtkw>Q-m4^^62WyN=_Kd_*1zj!IO7wG+|1sO*$F673h_ohQh98+jXh*w)8xpN&D-B2n zfurMTiUu*6XNt16+7ie``?P1iP>PR4Cm~r+cVm29)^&5}Y^=~;18~T&R#EU8u@ENYN@XbCyQ8t8 ziTAMG4}WGIN?k^b-6jB@-hAs4)j6j&n|j}FQxZ)e7`{TX%m}xF6cO ze^KsH>CY9LM*B7$g@d#r7_B}aSH;c1I@q>WPV3Bvp@~uULAeOTmL}E0zTd?i(sy@B z&w_imu@{6Gpk7wyQ%Q6@DaM&Cxd%u~zy4a~&r>1$Mg~&ZlH4$jV*5H_)2)0OPAz4# z)9o&vLKPSs%2W#z{cHRkrP=qViBH&Npb311T1dwK$UKceW>^C;ASGAa{(`6bO!iD+ zcf-E7w_ZjDPB-zg!D}RWnkLH}zGE|<17Au;A4h{k@>c4UzLynpu|BDa0U??6c z%4;8XAJU*q8nq#%b~|%%p2p3}mIPQ^rOIEHnPpngX%_gOhw!hySxa}&pufz;K>f2} zM|bRukE$B%$3h!6)b~undJ#bS+e#$80_;Bxmm|~&?Rj^;FqYw;%Lbpfi#7YwXJb~o?n|<*h_LCUs?J_v(TPR67Hy*WNCW?bUmHH`m;R!eS=oZQghTP#BNRO$A zXFRY}+LnSel+M3c=HUudpe#0Wq4~}u28E#i1++sv3l@+baE~&y*nv&ZWe*jTaMiy~ zCvg&xN+Ood9pbwgy508vFgz&|l*!%fi(BUHd^y`kB#U5@wdX~uG84INqCVR}e3vKe zvGqgdJa<)1|7NIuN7Q1N=yJUd-`N%*jDwY?$>~!kPvi1LJZ%8SM?^lr(=YL$e7?3Z z;ckzhx`;8ZvXgHNo4_Po1W6%*uUB3ep6__NEnW!+)DJBo+;1Tke>L-={D-qwHFA zBGE2=56)ep4&x8?VztKqLzrx}RjJ)@O)uh36kjldLh$##2T8JC55vZ!z~Lr(Sng|^ z2M*tw;96xw8hDcgOo0VrS|TC|huaVDEqG#3FzBpA=gp2_)_CkEIt2_{wuJ}-y_RzX z9`@&EtJ{1mvJdnAVRZ^8VqjMJW*az(0WC$}BH55iVy_^5Xd3xo5Qv{Jg#Pn1TLGLj z!3-u3ME6ICh zV4F$(6;ZElTKh?C6u7EHri|)~y=x-VN+GF-o25=6AvjHd3Mv@B!O zRdcn3>VUs;fW6g-N(}w_3)kpixUMn-)5#Mf8Ax#3b5OPeci&H>+DKar_g&VA+<0c@pRB@hj02gCc&x%{fnIydoU=+*+>zp&h>V4G=6PtwrH zEA#8*Yy+I&KV9UctI} z7mi=ovM$UGcMP{3tlnzu&|W(21MkQq_1Wm9)H|$y7qMQEms^5JP1lgoCtUwnY`Z9V zNP6Fip0Sasrp()92O6Cp2bF|i%Mhgp>$gLYMrD3ZYL%ua+aF0OqDSu?R%4n#m=tUzy}Yrd}EQcc;FH zT^eQ_GPB5-1bWlaLU!DP8>g#FuTFW&!xR$?EhhUY@vl4-sE}R>Fq151tG`h#?CBV~ z5OppYGgckN4#Kh$TCkju{>NBPb3(oA{7xXU=m!JV=*=8%BXi?f8{qG(RsXk4yjb{R0LFas3JFN2G*1($N^LDNHg%Ffxu7oYJ`(I##=aTPAD4OjGFPm zI%*Q^`8vhWB-8&`Ztft55QBM(FjEq>8nnpKDJh$s8W3jImPj$~SiLHt75+d>^bMAGZQDOt?VQsI9aB literal 4036 zcmV;#4?FN-XJsvAZewzJaCB*JZZ2L8%Gj3%uLoZNe zb8A62OKo~mQa5WxX-i>RWM)lvNLoowcsMXkF+~bXG(%B(Q*lZ+dNfmXPhoCQb~blO zF>Y^nPE%)1YB)tid3Hi(OLsO#Id2LrEiE86P*8bKRZnt8dNOE8D^EuFF#B?4V%LV9(DUJRjjQ?|qcPvx5I(PuE z;2Y5;OVX;$awxY_!QuuQ2IYau4Gov)#qsPL1Cr+2Ca`g452kB>(qk&r4cF}i{fD+G zX&*n>D01oo{rqjK7T!00qdngKeZ-xyh)DLiqvT*4tQ(Q~&5gY1^A)iH z#;j56l6+hmV9%~+jofakZO$-flmfoj#9TnP6SC5#4yO|XiqCJ9Q}m6TPB@wili&0V z&tMmSx9X!ymwgAyo6S?2+%dAp{X(C8uRKmohe}+eH^4*C+k7>kDv!_I8V+^?Bt6|kOCPdqmQt0VsJlPs%p&)aOulM0!4!R~wO_Tf6294t2a3O zS@JLHg3i5F?l#JYSUD#gVz&BlHBM1wzGSUagPBHTyo<~dtMiS900)PAJ*=TLOSz>w zf|8{oK2aW!cr5FPFeOfL4IzX!oEv8ZYYnNid_zdk)g;*%r0r?~{y%G{@)VJFPtvr=w-{{rC@}NUwIey|bayw(}XKf;^r6uOc z3S?IQ@Bi=SAsVuePJhN89#tuU6ezk^IOd4~y7Wl+pV8EC2d7t?G7sFBYaI$@a@l{4 zhW@UOhS|ZPS@OJMOp6+mEfD_s2yRb=_T0M}E9eP-4U)BJN>(D|l(2~X&+|Z^Hc(cS zl=>{Q&6MJ{L^GT$jtzcbK>Q>t9q>A#M*!Dc?uQ zY-L@cNEpgbB^1geXnf@zW}jetce4wNbi2mVa4sP@kH=aWz1Mjw_3*m-2T9p$$OCv$aZEoL7qW?k3<>Tt|O3+*Z79Y5U?}Ue<)K)Og zX*?Uv$ZAx0Qa(;*fCw2;8LkE12R;EjO`%vS*3j8O(31g7&HVE@Hzk3d%z-6KM}ih+ zXKI``mGpLQcp=+A7(b;9Ihk*9%H{Z#YT8#VOHJ#AN;$g0!pt=+)L&W$I{x`<236|5 zh;CPv!E(}Sh;)z-?WY)JDFo5^C)E)u1*sr`QpVVjaB6M@E8iPktw zZ{`i{^{K+(B~17f5nfx2eA$wL@F--P_5!8VMg#lBpvMXklKB$b=OelBFYlmnTCay| zz6pPEb~qiIq4)|69gOMbz#mSA`YvIu^;*d<3#b&ssI2bm> zK6IJ$jH8*_nfwe!Qsdkc7IoWy4r*k3|D7)^)H(ZCqw%Y5R=+V}5v_({7Hef{gett% zRtCtnQ6*{Yj3==EIV=z`)-5uTmS<+5R>1pwi@$jH3|$W0Y?!NXH8 zAdKLptmpf?xT-vE1puUchwkR#u1zmDwQ+-gluZrvXp4sDD~Cku#98Er~3vPGW-CHQw((fp5ET|Cp5-=-a4z!WiGTYK!z z7Obyy{ZmJ%dnq#8KH~%3k66KZ zBNsY`WSc`eqqjkvAFW{$_7elZN!C+h3sHo8>dWo*RiF*THl+8AjwHh)vn>0La4Jtv zj(Xo9Qvox1+>uh_Ds*OlJxgR)42`@2)NqO2_Vs|(yn1`kF{H*Qu_wjH78qkT?T)6o zcynqvI)bQ-*~awhnoC8G<(_m6k1J6ME3;h;#P!}k%{Y5 zLj7d5!I~~kkkk>Qf!K2jD;-OO2WwS_R>ZPy>R(+W?F}?c7hBx!fk)_ZQ24Ny^jw+L>NPTJopy>kw$W$ zpSzGkD!Y-ufz`Pp^uGl}#>v|r#nB3ZV!NHg*xUF&r*>(7`guna9i#F$yKRvSlX=Vt zJ)RdIIVHP>#{ocFo3Y)34`tlVX zS+vNR|P{QsW}b;*lt-7QlfbHE7PfcewQiDr+;M<2#t`ks4K4@dJ{orD|ZA-a1&m< zU*4WoeW+msS1RlZJHE@4??Up(NDzJ4ipTK@cA6h9xov2+gvb9zkIj=9~1J#=E@hud zGi=}Qq|}9PqSBM31c=j#a)KHPv9X>i?Bi-iu!I|KV<~qCAhx}FUVn5^WrBhP4Q^c~ zzP8yn=}$g{PZ+efSXhGA_@me=6QLHq~rTkub8%>9ui+;)3F zqc>lBd*&D=BIXZ6*siR@gCNj21L`p@7uU%7{)ctXbjZWDcXDLF&KzNfUxXDBU9^rM z1YZ}Tv_Pod0nKG?-LxCOKbnv}-RZ!PE9v*#L;hnSu!2Zn)6BBX`Q+?rDsh`(4tr8! z22vN<=(iHAGis8y>Tz0oP;KLu>TPQ2rdFo3*O&to8UDQyrZK!9g7xN2IoMJ##$;iK z+3w5GWIYtzaRn!fO1!S>Ds87xX4vz;`W7tKItEzs3@A>U8SyG}zHh6JR6!91SEnIV z0nbGSNifn*uPmls4LB=CxqW>5G*$vvv$0{ubb3T?0kcoy?m~z9EgSgnD0)eKl;D1k zDU=Np_A?;6E-*F@2&>J2FIL<`xoF;a&J9Or%cIPdKGaGv#rQo0+c*0D3dlA>wK=A@ ztE1(?8l1|@zWK;YhMn3OC(y-(w;R&%*|fhQ_~R5NM<#8`oeaV$s4~L7(xzd^sD;m+ z_grmB>dzUD>;a*sY&&VZrQ$zlMj=wWFp;}GP+?Myw z(U@iUr&D1Yf*3?}uXYxU|FM^5lB(?#t_J%)$rY-70V*YlLy_yBf+`ZxP9K#c+$|u*7t7aKi%&A(7i5m(6|_14 diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age index 196cd7a9abc808cf3c4ebb97ec660fccab0cba01..2fa3340b5d560f952b41829d37bd637a0b6f7504 100644 GIT binary patch delta 567 zcmV-70?7T$1k41GAb)jkD^*uwM>TI)L33?2WLRN!cSU+tG%;gvM>Q*AYMXJSEX zMQv7CcM57ZYk5ycHfdEeMr=acFi#b7N;jGDUYwaBy%#S1UzKW`A&GYDRNpc4rDBgYx2) zijQ1f_aIWcYZgdHFv(j_4d4(SH?WH{QJPgSbfTb)iZ;06#1Ar`yvj6*pxBCtY?mc* z)F&Afec!B`uPJdKwORfbtZ(_&phud}J)*+r!1!J{gTjPvO7CBNACultA_Jhqxlga2 zruTU@VTE>(=YO8(iI+5P)hQZc^ccj8*ua8(nlfF09`$r*A&rS3II?^QJJ#MI#*U)a z?on+WjBMzyTgtB*HI$*^9yM3&s9!WI*ANP7pZ3)_u~V_eBE+<wZo+wH_8+rzY=R$;EsaOR)j(+F`Q Ff`o=@3q}9{ delta 567 zcmV-70?7T$1k41GAb)aqS9D=;OfzY0YeZFULS{~9Z(}xgFf(LsP;Xj9Y*tZiLSagJ zL|R2?I0|EHLrOMcM`9~XXJ}|zICeE`QEGX3WMpJcPcvCVP-%2GMNwB*L`PUSV+t)T zEg(-raWijaaBNd~NpWLnH+Du-NmFi7c4tX#P} z8K@n=MYT__IPJ|>32#CUKJ!~P?(OEZDsa?+wDUSkC(3mga14K@ZQ@5`Q6j%@hwBSg zr-a#?(|MWScYnucEI~*fT0y`rXSj-F83oXh6GJ;W=_&(ia~|`~Auh|3yMw!GEbQ)l zOJgEdHt5F6yE#ub?)Day0h~&?F-Bv@s}T|RC&#m<1MP`G{9j~pPBuQQkVK7)rZ8AkhPcc|bL~TuTbY@m+bu)27bTKP1Ha162Nj79{ zHb_J=MG9J4D==;|ZdN!~dTdN9Vna|-Fk*UAG;ld+T6t9~GA}t~ZB9-~YI99wQ3@?B zEg(`tHds$sa#J}gH(^C*a(ZoSa%V0Bt&vTA@egMMOGEnR;|gesB#I51xrijOGSO{`yIp@ zN8At`&z^18nWlZWznvrFbSl84v2A)EG?v!>Kud|((UL-i!MXf@JH#h{N>)P0G$pN7 zYhSw{QhOBJwVrGh`SOJsVI1R~?IH55&XQ5YM~IKU%71y@LvLLP+3l*jvVnbw!^=Qh z--moUdE8@MmQeqiBLTt?h7iBwr~3(+3p3wn>wZM8%y-oon3iP6wJ2Z`OzV22O74`s zN>L)CQyXk>!Kk4Y^k?BY?jDe?Cb+yQtk#R~;vY0iZ^iM1b;`l+b$rIdKhwTDiPd0E zgou-cYJa}fu}UqDzVsz99+#b0A234NML3gGpH%Z=s~~vJmfrR?Mj7X9@#G&<69(tA z*8+P3S?t@rn`37K1g795VWKCGx(!3y?}%<9Kx(hmW}^>R&c&9Jcd-D;cYm>#=1)Bvr8usnxY%Sai;GgAxlGQ( z|E1rJr znXwkmUsk%%aFN>NWo-4%P~xSoEzc#9MdXe|x&Ns5-1YN2VSfd{`TnhdIw^mGJoY6w zvXG(iqL~Mb7#10HRfL7KM&-Bk283_HWUoCsn5kZGtCx3zLccY4>cfA{1rD!^_Fu4V z7`X1^;ML(b0o{*r$#^IB;F60nl6R6LQ`097R10j*Nb{N(anp2n#CEv$ZqpL(+W5sQUCw| delta 1126 zcmV-s1eyEy2=@q(Ab&x6OinX+baQ7|N_uHGZ%c7OcyMl7D^E{TN_uoma%gvYcw{+F zL`8B~SqgA4S6OsvQ&3BGdPOvMbXZwMIB8~OGFWXyFj*^EQh8-jcw<^)aZE~8YYHtb zEg)k|YfxiOax!jdLuoc=IAJ$Wb7eGnS~fRFdNN3MXE<*;NPkvnQ)z5xPHzgor_?Wb zIC2hlseoc)Onn{S9+sWrny^8TLE8b*wrz>;Mi4ecPyXyd^V|%llpeQ+(%9x*i2)+B z2M=f%C2!r3t_wys;y8SEF?dk_Xr#r!zc2IM?bA1|nl${agyR%@gX(V~olVCUQroQn zT<$Gs`>Gn)DSy8ZZT#1Rx;~g|44LpGw!5@?2;{R@b@gzQ9(Rbr6dJOkaGyRQNO6zQ z8n!xC3>*Mgw_8~NtOEcfi1Utbb@qW%qr!_VYtP(9iXy_GGW-V5S@UeCU7j&Sn-+cM zK0^E@uv}e+P+T1(VBs#?(rj|`N=j=7{;53uI^FWuQh&}sbhL6mO$Q512|?Mn{<-xDc#>f`jgj-Coe&>EHL)htz0GZboO8AgcSTP&Y_R2J?!M6tS<(y z10R4b?SJ=x-b`-dYTR(~L!XIz1NkJT2?helw%oU-H1!VpuS)Xfc}_3jBKcx zZtpp=(d5N7wxsZa&lp0K8%{~H$3&2`0yrg-aWfS0{YP~-jM*zzEm7YMOTc~JdZ-eO zA_|#D1Mi%%%%>~tl@6uD3%-DkosI!hsb{tgihqsadDY)cK+osz(5=9@+u{hz7p&IP za2dQe@}B;LPW}a@CO%@_OCZdV&X+=J8cHs0|89SntFk+R4LSUEN6Dcl;}%qww03^v||Iwnf@CU%}qe zzJHb1F4uWM$G=rA9}K=EGoKenab*Jd4$Yc=nK2;tpYEDz%n4v3ArWAR+G4VeltApp z^(8zeeXJl!DL0IR{Ia%W>auKn9h?*xeAB@2u%6dwkG@1Xh@bCT&f99XNso*uBBf&E zt-%%frgYG*z~`=}V9obrEs1>V1KAtZW`E)l1Yzx#VR`t|1z6Hy>k<|hy&%{=#x*m$ z=*R?l*xl&2DE$-)_@~-Ky}0eep{&5JOGotFMhRi4Cusdh$fe`JbfvXOM~-eh{ghn- z0hKY6cDNKy@WG``V3Fqi(f44fYd-C<#W33!<#XyH{Wj*BM%R2NTA^dq-e643_(WO^JN{@zU2EfMkZXX> sjbDqY=&V1Kgc!bv2wpaklW_S!+X%hMrTTL&dcb^$1kwbMAb(R+LTOA_RcTUbSxZiMaCJ;^QBh1sMRQJBS!F?WRC8f8R7E&* zF=bO}a|%;)FmOb0Hg7UTb#i%Td3abaF*s;5HBC}hZ!mf*XjEcJIZ-uPST#;JI0`K- zEg()(L2@%wX);7uQhH)IPj`7}MmJ7cdP;I-LsVHtPdREubAM87Yi4+MMpX)EUL4Oz z^x8lwr#aBD6hgt?XHWn>g(;DO?#+NVdeP4pntWuE12G*QfmTmW>Lv#nLy0fS<_j={ zxl9Dp<1~Jv&Qk z4h{BYdKNTm;(tR-9YG*crCnre8-?Ve_N2TM)X8N|62X0MES;EY>TeeNU@iL6mi^ZO zG)4iw3<1C;Eb(fE`#7{w%zRo`3$4ZY#w79SOE&|hBf6wLAIZKgVW=_Lm_+~A+tTWa z0i5H&M`5}bgc`knn6bYkNIzPWcfvZ+JNgE5&TD7fx;YzlX{bB#OF!lIKUOOY9JEezv8zVq19+Py-4j|MH+&ql;mX|!Ty zZ}+~1%P#}oTO!s=7o=@ax5B9BvhRc;K=T{DyxO|bu(j1eZiNo*({}cc&AV>#OPw3= z@K|je$2Roar%r|luGU|IU`;>O_2R^#c_a%4ENtX$cIRc(w2Z4SS!FfZ6RL5Xi;3;* L8O?~ds1db^$1kwbMAb)H`OlD<6MpkS=S7I@BF-mV$G-*&qIcirpPf>JLP;qEgRx~$6 zFitCOa|&v9WlU^Zd2M5CLvL*{N=ZjfNm*J(K~_*PWlT;?V?|{vLuqC?Lt1D@FbXX# zEg(5ZN^3$zM`}56F-JmLcyd%mR7po;QZX+ybVo^UK`~KEPk(nZL1J`GD^UvjnRf$t zcH)uky|Ckby<5q-=y9%??+U}Q1Qh5(2*U!ySnGllW7>=o)PA{QPyV5ump)lV9yqoZ zZW`*EKQmO#tTqtHQ6kELx=IC2OG)2XfK5H=Kd|(B40vnum6W*k;CmAQ*Eu;fD)491 zg54Sd&28z3e1EUL`)z%nFxzg;8J@c*z4Rac-^mBxo5MS?u4EE|^8o-bMVrhITyozq z>0<1s2fiMjDhXz9=SO~7{&|9avPXprQHzM{dnrDNbMIpO*JcY%76bY(H&L*c_{&GJ2Q1V!=01N?UXkb2IG85Y L>l$~!yeV|8-QfJe diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age index d365e834191bef750ff4a41e19173dc2553a6af0..f52b5eec87ab00a849f0f27340a8582e0232103a 100644 GIT binary patch delta 273 zcmV+s0q*{&0;mFzAb&YAZg4MZNGn-)S~qNIHZW^-OL#|0Q&2QkQEqK_RWf31Xk}4Q zFhNsPMG9tOQf6&WOEye!Qc_k!W@bc0GfzQJX?JF5a8YkHS1(y>cuZ7CWMXi5RSGRF zEg&#$Q!;H-crr+7OLtUAY*A2ZHcB~5Ha2QbM`cn%LTp%VIe&M0LUBSS$|b!OF2$XMRN+?JJlg- zcvXD&jYCgAV@`RU2B}Mvcb){U;kMm&Cdt{Kj~lDb3LwN}mLz(zuzWcEf9 zQwK#Id>f3cQ^}#S<D=}4SN>5czRbxt5cTzb?d2MTOZ&plkNO)mwM_ET| zc1$*SO$thBWkps|LT6YxN<>C_dSZA|NJ&mnMqyG-LpfJ+O+hnfOk`C{b$2gSYYHtb zEg&{nc1cS}cQZ3=WNkB3dU!!;GHEYSbYgW$bWb!gH%4SDSASANFKtvoMQaLVA_;U& z|9CMWlFZpa^=jTfRSTLa&V|_{4w_d8cPwz=tgpQq`mO=0rI17!7b-Lcz8{+?Bg?ad zxj}ZxRaTL4GtKl54JW)DseZFmh-9PpLe(k)Cx1!zZd&@h5~E5@$4m+A1`j#Z!4SF; zhD2LRmoQ1IvI+8U-FIw)!)3l}4($3wb;p#P@l8Kl_~m&UFrZ+#}?4cJUnhUlUn~=`YR@x)>w{bs z0u+=jO!0s>D!2EIzZ*nVqD9MNf?I{=q#iTht7|L221U#N`gGy&h|-dRA85})a_g<{ z-+wI1XI_D1%L6M6>o%@A$Dx|UWBHoh^vff-$8hS7bG`o`QoX8culT)sjmdS?EmOwj zgQq)Qv`*6?3k?7dpnF&L?)W3w2Sb}>p?>dEZXlP zPgQwI*3;~?H?;EZwvqw5)}8cHf&NH(f76!lrB`QDYk0I@FrRApvV-Z670DgC&AmQM zT16Ts8csWnJh)=|D^@A$2r>Ln%6}*a5mL$P9)KEjZSXjk9nkA4%xsUetPonvzv5Y8 zCG_Pia%aAy9a+CT*JObX#;JCZRdqU%A;(JF@TFp`AbMKRvQ-+qYO@V;qnxmw3VR>` zWN#>>^wGW07KmQ%Lif(SSd=CHa)y9$(UK5s+GWL2P$%3*;m;!Y{+RIchJR2d+&vck z#fH$xjqcXmsMOe%iO4LK*D7~yIT9k}g9%Cb`a?aac*)U0OaufXOl7kGi|tbHfF2%< zO4u_*L`+Eur)Qd-LxZVI9XKkH;DF#1FfRDaCBzxLAc007F>|&6dfJH zIOp0OYu4(Gy?53}W$mhe2Y==0bcKfS3O{c@!frszXP+)Pf)6P`>$1--i)8x2J4;(W zQ!#nbc$ZX~R++TBXiv!Yjcqk)5V@B%rT13^-e%zc~8qvJ+gU+>Sv;m(_UH_q| z92JuigjKIQD`$Y+hCD5fjw62hh~5}LNk_N^t7~gLIDCr5z5#n(^4j-*_cfUiKsBGv zgl3>-C^;8(#EleO#iV)gkR1b!Yr{n?2IFz$$TH5$C$*|%+*1KLF=xgS!9mAr7Va*6 z^HZUu46rUS3J$&Rn5Q^ zV=-6qUS*$`9t)ql$hAO}9+^OB`>U%(qH^e{D-&Q6UTOKr>hTOv;WeX;6bYhyl=1`5nlKj+HE($ zpWjUDUJo?p_kW9%GbW&3d?Yfe{_N>O@1uVOc$Y;8ioP*F2lN@_MsHg#w#GDkLMZ8B3Zacf~SWl3XsK?*G` zEg()cSVBctY&AtTdRk66a%p;TV>xeZH#Ti_M@Uj_M|Wg&dVgeZNOo~{G+7E17HYgo zu#`@niTK$<^R0l?6u3QU@bGNAssS9sGdmkYFls1Q${j*iZ&S*SYCXSORkH(0VFm z9gk2LEAx9s09!f@H2;HLep-$}pKV(E3hezm0K33OlJRay zWRnYTTLV8#!Un+#1?9wwC24E5rL3y7O0<)a)XF+c0IUz~ zGRlb?5-w10aUd#onfYosK9cmO$`0*>s7^d=2N-z|<pP^dLsHLEM2xE_xxq2N{ zQLyFQv_^R;d>ePM1?F;wnDUn*IFv})7S+^oZ&+TE*DV7 z)qi(XN7+{-{g%aC{E$mn8U64CSkfy{Z6W=6O{TVXjh>q(_<4Nie49P)$8g$RLGn*` zUv-A#;5M5f85NZUhP zDIRT(q2}1}u=KR}-zW9=qZN;?Q};fYgTW*CL%NOpS2R8JVozQ*y?$xNxz)VF2Qp!E zJ_wKqR=Mx)_VbV2xT>{tKOT9^_hsxA_29Qi6_AFJ{|U>WWI`X8!jb=Cya*pe%A^0zq^{~m=J*8%k#49+!mK|zNqh=Cpqofe#|vpW@tVb?4RoI0^2 zd{~gaOKh^-KbPKOasE)D#7iJ|U_X&svRxmY$J{Vo-iuT|r&7Rl(@+JVl_mp~YsQ9$ zO6&^IE_`Dv*x(wJ#h}Ie+2cog>uV z=Z8}Dn%TI03x`ur&>TO6PUH3uvFw%DnvoYThA(8XVbmG+f^;G=iu;rOzajM^(eTsW z`zDTzuP~4d>z$4n&w(v#R(}Ia$?4{=GsSh@T(6bloZ64H9=QG4E!#lp4}}$e@O_Km zWkzgf6tD)tYt3w(F;RaKB{l^w(#i@pR2R%K`R}hAdt%B~CsJ`=P?6**dhr z4W-ZV;gQ!$OwcuHSY*fH7{J^41gDPVCF)jdgUV=l+(gm{pF!FQBdyn5^tAljm}DuO zCekmeTPy3*!|d{2S~xqW5(b3-JBgU3EJ*f*QR$`|6HQcO9G-mD`4H)LCxwE~KDLI; CdY(rB diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age index 815e68fcc681a928f2aaacf7a2e8b96166cef664..f56887b527928aa0918fa347c21f9020a2dc00b6 100644 GIT binary patch delta 630 zcmV-+0*U>L1&alcAb(+IQ8h7cSTk`;PdR0AN=ZgyLN-lLGfj3mSvD(3Z)h=MGC4|V zIZt&~X9`AdQfEwNFh@gbZ)G`RPg-SbSW!txI5jglVNgzTD@I95VQ^<-V@_&0a|$gj zEg)J_I8$**VN`TTZ)P-kR550DI5BQYHgiUKL3c-Vc1UJKFMnrsP%lSiMRN*3PuW`o z5Sr!!@~gpZV3#1xxqiaFnViv;m7rIzCKmOK*cXSmzm)e+J)A^>RG&wCJrs7LK7=t7 zZUC4AHvm{NYQ_lGjX7;tcq8j{+6{(vJ&;ap0`FPS?X6Y#iwnKbV|0bcFDU?rtW!_x z9zRbaNu8*uq<;al&9bLE)8K_XoLCBNxTFl`)t`YUIc19KMfpGP2HkLtsQr^r1q}_8 zrLK<)w57*ICfsAZXtS_UQ{Ytb=}V#c%n)-JxU7(p1A_laDV7I`bU^(QY&nZ!!Q(8BLhsN z5s`sdlnc1F6?OgQ8Ef&!@8M+O6TH||`GQ`QgZn}ZAILmM5S2#UpXrivOJ@T&0rpEQ z?C?gK)>x0@0#9NM1Lzhq(uT4~vvlp|sAGlzHO~}PHYe|HGM^oSN1fSN(G5$9M{d&~ z7IwIwEN|5S_RKnmN}^hJLlboen{eHEpQz5QY7mvETLcKSxu(O;y;tq5OLx~KcCwaq zaoVoJs~1}H;l5^g8fwi2P^%^*;92TBjh$6eNcz(wQ#rwUw&a*gB;GfwMCq&MLTB9X QdH4Jhc$!(K%Va9G6QJfA`Tzg` delta 630 zcmV-+0*U>L1&alcAb)T)Z7@kEVslDiK?*G` zEg)%aFjGuXFJnP+b1+D6W-mp0ab{_5Ms;UUNo`A0STcB2WPdV2LUK|@X;liqp51yh zp_wsX=I)VPcts%i5j??1(S;U4oF%Z8v^CUyB=bp?QngSfIIK@i28mCmq+NMjW2s&= z>-x=_9~!N1j-L)EzD9od&etn0X`Ot0pU=sCG&UJ&=N^Ow8r{G6?Q@2p3Mf3ch}bGq zJdRATiG;^v3V+0-TEpjkK(E5Sx3Jh`D?01A;Mw(u#CwM}Myx$j8iz<4^Ksm*zJ@s2 zpJ1RW;N$bwh9I(^sS7o@lO{C!E>?WI~yp z=JXH*Z$`X*9yl@(m_}cfSoLSxzuHV-NVCV6FueWa4K^9Zq3I>?E3-0s{Woz|6f8^i zGDO$U?}&MmSww+~LZU=+)Xl>L0CD2Hf(xSGk9WRFE?#wGc$EWFmFO~MrveOYDG~?HGg7Ob#r)ed2u0#i znA)IZ=2}dBBWYL5}KJ`xXq~Q9&RrZ+?&= zGR0x4G{_qk{Ucdzcbo3A++z6`1R#7`6uyS_6+qYWZs+=Z^hwC_iOhreqBQxVYJHc* ztW!nWSMR6u+9Y*gj(`oXM*2(Qx{Kcm_){{o+zP&CaDO6$Q=5s1KudxD=T#GQu3yST z)S(aY6zq0-<&oK~J^gU2!23dv)bWaD{xWYQt6F3dBB2mp=!p%U&f&yw(kX&JL$_DD zSOmR3ulH`Xf+fN_h5&2J9M~AhO760M2>yM_bBbY`@vKyQit_yUKv)BNr1-F_5^Zmk z%?f9~tAE|7>@>mhjtt-_%pm{3;yM##>o$Z99$R4480WpCSlh^PwFR%!Q^gYU39AE} zykw(v$4jpttmJ6Hc+gs>04v7MVPeR5xiq$Q1pwtltq;9wmFHN>{4sK*z!P{6T6W(J ze9O2a^6Sj-_k<Z!kSH)gG0Zf(4dZCr}p5a??O9p4?u|XLw{joli*w ziht03n*&IC>N>}q+kR5N)Rwh|kWsQ+_=N1W^fN1FQbO{$YsU<`m!^LEbVipYt@uWj z|9fWhx#uZtVUL|5oADury-}~C8JYS@klY_Oio_mR)mlb)yvY(HZ*lm(*ie?wvg3;1 z|Hnq6STy!{ZB8n}$zmj<)NPrHe4Ti6wSSTSn->wl7j#_cPrwnao4BpiLbI*7yE1Pt zW%rkvwH{#DzS4R+xC?XSYOJ4@cUCsZ(o&)#I44Y+>XHLunr|o{>oG7`f8^oXn{BC$ z!a*6&2E`6m@`nHW0ISscl2Ie~^4So~^-tu6un)R5V06G)hWMIdo`rOf_y!Wio3)Zsn7=UlasYZqL(S!$x}oZ=zr`J8Dm87tTDJ}JMtUQ z2Ic6utep5-gEn^h#4}*!v=Hsx(>q_NC4|s(%SAfa^!-f7j^hn?-i#ii8%J zVFjL$R(mYvDJ(a0lfa3$V+&f1!w(j=vr{eu|Oy zWaoe}v4kp(L4g-=$!&IRau;HN-;MD7$9XAGW;dj?{v@CqbxNSv z5%IO?ilXl?o;~y*YrN?bUnesDnY}KoL4V>6>MH~ZEK$6buPN@O&*G^t7K_LVnYmjR zo_l)JAb&HNC=?EhmOMbk!(y8*)`H>|!ntWl*anA=)S&oZcUs5Wo4%f?1?AXyAu>vS zi7HvlR1}&DqNXn-RF0dT?c2t1-yB;g2W_pYUh}Sp&hP8noB2RU14TA$mbObj(>)}w zy~7RGQRJfBa|^@yCs%~bI&Fj;kgmKWBoPpIT7QQeq|c;zn6f%&q@Zjp*hJq|%9$WQ zzI&ruRa^KBjW=p2(leBqKdjO-t0*ra0BUlC>trPWq<2NI)wPa^G_vi`a4`gO&&yU# zef#6_dqCNchV*!Y%g2O#)s3B^8KxmTWZ!WV4)Lf2qrue{&$YR-J5QtL|9ZvRY8CmQ znSae&>8a*9W%Nk02bSF?C3bz-HgKtR;M{KFs^S802_`OCUMhBb0_dCE8qh6yJX37Kul-N%N8Jf;4Rt znd{9FF-)}#!jPZ9@IcbKiaNRgmyVAwg?|J}Vq`Mch`4g~f!7L~&loR#;{RpH{u78;3ZS&z?w0as`AnCYS_teW{Z~#icrr`gaPAT(FZY!fYQTs)L)jw z0{mW!GP!O;K6LxHOiG?U-eLxbuCXR-T(jq diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 2a99638..4b9adf0 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -193,6 +193,13 @@ verify reads the dedicated Secret and requires it to equal `bindPW` while presen `deployment.yaml` pinned to the new image with the `KEYCAPE_LLDAP_BIND_PW` env. The new image also carries key-cape 67a0869..e2c5a94 (online token status, inactive while `tokenStatus` is unset) and identity-facts. Founder order: approve, setup, ESO apply, verify, deployment apply (image + env), login, clear-password, restart, login. + +**2026-10-31, `svc-keycape` live and verified:** CCR-2026-0054 approved and binding confirmed; founder-run setup, ESO +apply, verify, deployment rollout (image `main-e2b5fa1` + env; both sources equal), `admin` login, `clear-password`, +restart, env-only verify and a second `admin` login all passed +([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered; +`keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the +privacyIDEA database, not a Secret key: needs its own design). the env. ## Synthetic verification instead of a founder sign-in