coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement NK-WP-0021 activity-core ops SSO least-privilege.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
This commit is contained in:
tegwick 2026-07-22 15:47:26 +02:00
parent 3580e43e5f
commit a9aec541ec
8 changed files with 384 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

19
sso-mfa/k8s/lldap/README.md
View file

@ -33,7 +33,14 @@ kubectl rollout status deployment/lldap -n sso --timeout=120s
## Post-deploy bootstrap
After the pod is Running, create the two required application groups via the web UI:
After the pod is Running, seed required groups (preferred — idempotent):
```bash
./bootstrap-users.sh
# Groups: net-kingdom-users, net-kingdom-admins, activity-core-operators
```
Or create them via the web UI:
```
https://lldap.coulomb.social
@ -41,9 +48,13 @@ Username: admin
Password: LLDAP_LDAP_USER_PASS (from KeePassXC → net-kingdom/LLDAP/admin)
```
Create groups:
- `net-kingdom-users` — standard users
- `net-kingdom-admins` — privileged users (enforce MFA step-up in KeyCape policies)
| Group | Purpose |
|-------|---------|
| `net-kingdom-users` | Standard users (all human accounts) |
| `net-kingdom-admins` | Privileged users (KeyCape MFA step-up / extra scopes) |
| `activity-core-operators` | App-scoped: browser SSO to activity-core ops + Temporal UI (Authelia domain rules). **Not** platform admin — grant consciously. |
Operator membership (add/remove humans): see **[OPERATOR-GROUPS.md](./OPERATOR-GROUPS.md)**.
## Ports