coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: record verified identity provisioner credential repair
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 22:00:37 +02:00
parent 2bc6e37f9f
commit c8ad7a85ea
4 changed files with 41 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -132,7 +132,7 @@
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
| task | NK-WP-0036-T04 | wait | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
| task | NK-WP-0036-T05 | todo | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T05 | todo | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |

16
docs/evidence/2026-09-11-native-portal-repair.md
View file

@ -60,3 +60,19 @@ seconds; Playwright opened temporary pages for previously visited origins.
After the operator reported the repeated page activity, the helper was stopped After the operator reported the repeated page activity, the helper was stopped
and changed to cookie-only persistence. The confirmed tenant submission was not and changed to cookie-only persistence. The confirmed tenant submission was not
repeated. This was helper-induced UI disruption, not evidence of a tenant failure. repeated. This was helper-induced UI disruption, not evidence of a tenant failure.
A subsequent Create login failed before directory creation because the provisioner's
LLDAP admin login returned 401. Reloading the old credential did not repair it.
The operator then ran the reviewed identity-provisioner-reconcile.py apply with
the current provider password entered only at its hidden terminal prompt. The
sanitized receipt confirms provider_login=true, consumer_login=true and
provider_password_changed=false. Secret UID c6a9e6be-5bb5-47e6-9faa-06b8d72afec3
is unchanged; its resourceVersion advanced 51345775 to 60026132.
Independent verification after the operator receipt returned reloaded-check-passed
for directory authentication and a directory read from the provisioner. Deployment
is ready 1/1 and retains image
sha256:5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06.
NK-WP-0036-T04 is complete. T05 retains structured dependency errors and functional
preflight; RAPPS-WP-0014 retains the actual native user login/password-setup proof.

22
docs/identity-provisioner-bind-repair.md
View file

@ -1,13 +1,13 @@
# Repair the identity provisioner's stored LLDAP credential # Repair the identity provisioner's stored LLDAP credential
NK-WP-0036-T04, 2026-09-11. Prepared and tested; live apply has not run. NK-WP-0036-T04, 2026-09-11. Attended live repair completed and independently verified.
The native User Engine Create login request reaches identity-provisioner, whose The native User Engine Create login request reached identity-provisioner, whose
LLDAP admin login returns HTTP 401 before identity creation. Reloading the LLDAP admin login returned HTTP 401 before identity creation. Reloading the
existing lldap-secrets reference did not fix it. The tenant and user-domain existing lldap-secrets reference did not fix it. The tenant and user-domain
records are independent and remain intact. Root portal login is working. records are independent and remain intact. Root portal login is working.
This is a proposed attended consumer-reference reconciliation. It does not This procedure performs an attended consumer-reference reconciliation. It does not
rotate the LLDAP account, change signing keys, restore an exposed predecessor, rotate the LLDAP account, change signing keys, restore an exposed predecessor,
read a Secret payload, or rebuild KeyCape's configuration. The operator must read a Secret payload, or rebuild KeyCape's configuration. The operator must
supply the currently working LLDAP `admin` password from existing custody through supply the currently working LLDAP `admin` password from existing custody through
@ -34,7 +34,9 @@ python3 sso-mfa/k8s/lldap/identity-provisioner-reconcile.py check
It authenticates the existing admin against the pinned in-cluster LLDAP URL and It authenticates the existing admin against the pinned in-cluster LLDAP URL and
performs a directory read. It changes no provider or consumer state. performs a directory read. It changes no provider or consumer state.
After explicit operator acceptance, use the UID/resourceVersion from inspect: Use the current UID/resourceVersion from inspect. The following command records
the accepted and completed 2026-09-11 execution; its old resourceVersion will
now be refused:
```sh ```sh
python3 sso-mfa/k8s/lldap/identity-provisioner-reconcile.py apply --expected-uid c6a9e6be-5bb5-47e6-9faa-06b8d72afec3 --expected-resource-version 51345775 python3 sso-mfa/k8s/lldap/identity-provisioner-reconcile.py apply --expected-uid c6a9e6be-5bb5-47e6-9faa-06b8d72afec3 --expected-resource-version 51345775
@ -52,8 +54,14 @@ restored. Other login services and the LLDAP provider are not restarted.
Seven synthetic tests cover exact patch scope, stale metadata and controller Seven synthetic tests cover exact patch scope, stale metadata and controller
refusal, candidate rejection before writes, check-only behavior, stdin-only refusal, candidate rejection before writes, check-only behavior, stdin-only
value handling, redaction of child errors and the apply/reload/proof sequence. value handling, redaction of child errors and the apply/reload/proof sequence.
The live metadata-only inspect succeeds. Live check/apply requires operator The operator subsequently supplied the working password only through the hidden
input and is not claimed by those tests. terminal prompt and completed apply. Its sanitized receipt reports result
reconciled, provider_login true, consumer_login true, and
provider_password_changed false. Secret UID is unchanged; resourceVersion is
now 60026132. Independent verification from the restarted consumer confirms
directory authentication plus a directory read. Deployment readiness is 1/1,
with its existing image digest 5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06.
No native user/password-setup completion is inferred from these service checks.
After success, retry Create login only for the existing intended user, inspect After success, retry Create login only for the existing intended user, inspect
the returned password-setup page and record the native identity linkage. the returned password-setup page and record the native identity linkage.

14
workplans/NK-WP-0036-restore-user-portal-client-registration.md
View file

@ -113,10 +113,9 @@ identity activation and product accounts are retained in RAPPS-WP-0014-T02.
```task ```task
id: NK-WP-0036-T04 id: NK-WP-0036-T04
status: wait status: done
priority: high priority: high
needs_human: true needs_human: false
intervention_note: "LLDAP rejects the provisioner's current admin login with 401 after reload. Prepared consumer-only reconciliation requires explicit operator acceptance and the current working LLDAP admin credential via hidden terminal input; never send it in chat."
state_hub_task_id: "3497d77a-1dc2-5fe6-8784-33949321f556" state_hub_task_id: "3497d77a-1dc2-5fe6-8784-33949321f556"
``` ```
@ -130,8 +129,13 @@ The non-printing, field-only attended repair and seven synthetic tests are
prepared at sso-mfa/k8s/lldap/identity-provisioner-reconcile.py. See prepared at sso-mfa/k8s/lldap/identity-provisioner-reconcile.py. See
docs/identity-provisioner-bind-repair.md for exact scope, operator input, docs/identity-provisioner-bind-repair.md for exact scope, operator input,
metadata guard, candidate authentication, apply, reload and verification. metadata guard, candidate authentication, apply, reload and verification.
Live metadata inspect succeeds; live check/apply is pending current operator The operator completed the hidden-input apply on 2026-09-11. Its sanitized
custody and acceptance. The unresolved warden route is a pointer, not authority receipt confirms provider_login and consumer_login true, provider_password_changed
false, and the existing Secret resourceVersion advanced from 51345775 to
60026132. Independent consumer login plus directory-read verification returns
reloaded-check-passed; the deployment is ready 1/1 at its unchanged image.
The existing native user can now retry Create login; successful identity linkage
and password setup remain the pilot onboarding task. The unresolved warden route is a pointer, not authority
to export another live Secret. Retain NK-WP-0033's separate incident residuals. to export another live Secret. Retain NK-WP-0033's separate incident residuals.
## Make dependency failure visible before another human onboarding attempt ## Make dependency failure visible before another human onboarding attempt