coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T19: done; founder ran the isolated existing-token MFA check on the actual backup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Restored LLDAP, database and original keys in one network-free namespace; archived
resolver repointed to the restored directory in the disposable copy. By user and
realm through /validate/check: wrong key refused (error 907), wrong code refused,
the founder's TOTP PIN+code accepted. Loopback only; cleanup verified. Does not
prove the KeyCape consumer login chain or production token validity.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 18:49:33 +02:00
parent 5008e34f1a
commit a9f68fc8a2
6 changed files with 116 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tools/bootstrap-recovery/README.md
View file

@ -43,7 +43,7 @@ T42). After the age key it asks for your login name, then the PIN+code you would
`isolated-privacyidea-mfa.py` restores LLDAP, the database and the original keys into one network-free
namespace, repoints the archived LDAP resolver to the restored directory in the disposable copy only, and calls
`/validate/check` by user and realm, as KeyCape does: wrong key refused, wrong code refused, your code accepted.
It reuses `isolated-privacyidea.py` and `isolated-lldap.py` unedited. Fixture tests pass; the actual owner run is still open.
It reuses `isolated-privacyidea.py` and `isolated-lldap.py` unedited. Fixture tests and the actual owner run (2026-10-24) passed; T19 is done.
`run-isolated-privacyidea.sh TRANSFER_RECEIPT` is the token-material/audit recovery step.
It asks only for the existing backup age key. `isolated-privacyidea.py` restores