coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement NK-WP-0021 activity-core ops SSO least-privilege.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
This commit is contained in:
tegwick 2026-07-22 15:47:26 +02:00
parent 3580e43e5f
commit a9aec541ec
8 changed files with 384 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

37
sso-mfa/k8s/lldap/bootstrap-users.sh
View file

@ -5,14 +5,17 @@
#
# What it does:
# 1. Authenticates to LLDAP via its GraphQL API.
# 2. Creates the two required groups: net-kingdom-users, net-kingdom-admins.
# 2. Creates required platform + app-operator groups (idempotent).
# 3. Prints a user onboarding checklist (groups-only; individual users are
# added via the WebUI or by re-running this script with USER_EMAIL set).
# added via the WebUI, create-user.sh, or manage-group-members.sh).
#
# Groups created:
# net-kingdom-users — standard users; all human accounts go here.
# net-kingdom-admins — privileged users; KeyCape policies can enforce
# MFA step-up or grant extra scopes to this group.
# net-kingdom-users — standard users; all human accounts go here.
# net-kingdom-admins — privileged users; KeyCape policies can enforce
# MFA step-up or grant extra scopes to this group.
# activity-core-operators — app-scoped: browser access to activity-core
# ops console + Temporal UI (Authelia domain rules).
# Not platform admin — grant consciously (NK-WP-0021).
#
# Usage:
# ./bootstrap-users.sh [lldap-url] [secrets-dir]
@ -120,15 +123,22 @@ create_group() {
}
# ── 2. Create required groups ─────────────────────────────────────────────────
create_group "net-kingdom-users"
create_group "net-kingdom-admins"
REQUIRED_GROUPS=(
"net-kingdom-users"
"net-kingdom-admins"
"activity-core-operators"
)
for grp in "${REQUIRED_GROUPS[@]}"; do
create_group "$grp"
done
# ── 3. Verify ─────────────────────────────────────────────────────────────────
echo ""
echo "Verifying groups ..."
LIST_RESP=$(gql 'query { groups { id displayName } }')
if [[ "$LIST_RESP" != "CURL_FAILED" ]]; then
for grp in "net-kingdom-users" "net-kingdom-admins"; do
for grp in "${REQUIRED_GROUPS[@]}"; do
EXISTS=$(echo "$LIST_RESP" | python3 -c \
"import sys,json; d=json.load(sys.stdin); print('yes' if any(g['displayName']=='$grp' for g in d.get('data',{}).get('groups',[])) else 'no')" \
2>/dev/null || echo "no")
@ -148,7 +158,8 @@ echo "════════════════════════
echo " LLDAP group bootstrap: PASS=$PASS_COUNT FAIL=$FAIL_COUNT"
echo "════════════════════════════════════════════════════════════"
echo ""
echo "Next: add users via the LLDAP WebUI or LDAP provisioning."
echo "Next: add users via the LLDAP WebUI, create-user.sh, or manage-group-members.sh."
echo "App-operator membership: see OPERATOR-GROUPS.md (do not auto-grant all admins)."
echo ""
echo "User onboarding checklist:"
echo ""
@ -157,9 +168,11 @@ echo " 1. Create account in LLDAP WebUI ($LLDAP_URL)"
echo " Fields: username (uid), display name, email"
echo " 2. Assign to net-kingdom-users group (mandatory)"
echo " Assign to net-kingdom-admins too if privileged access is needed"
echo " 3. User logs in to Authelia (auth.coulomb.social) to verify their password"
echo " 4. User self-enrolls TOTP at pink-account.coulomb.social"
echo " 5. User tests end-to-end login via an OIDC-protected application"
echo " 3. For activity-core ops/Temporal UI: also add to activity-core-operators"
echo " (./manage-group-members.sh add <uid> activity-core-operators)"
echo " 4. User logs in to Authelia (auth.coulomb.social) to verify their password"
echo " 5. User self-enrolls TOTP at pink-account.coulomb.social"
echo " 6. User tests end-to-end login via an OIDC-protected application"
echo ""
echo " Break-glass account:"
echo " Run: sso-mfa/k8s/lldap/break-glass.sh"