From cdf7aa0c772500cc288b47aaee542714bd53184f Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 28 Oct 2026 19:25:30 +0100 Subject: [PATCH] NK-WP-0054-T05: svc-provisioner in lldap_admin under exception SI-X6 (founder decision) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56 --- canon/standards/service-identity-privilege_v0.1.md | 1 + tools/service-identity/declarations/lldap.yaml | 12 ++++++++++-- workplans/NK-WP-0054-service-identity-policy.md | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/canon/standards/service-identity-privilege_v0.1.md b/canon/standards/service-identity-privilege_v0.1.md index 8a559f6..1860a63 100644 --- a/canon/standards/service-identity-privilege_v0.1.md +++ b/canon/standards/service-identity-privilege_v0.1.md @@ -292,6 +292,7 @@ DSM-EXC-001 binds violations of a canon MUST; an exception against a rule that i | SI-X2 | SI-10 | LDAP bind accounts | Static long-lived credential; LDAP has no lease | Governed residual secret (DSM-TRANS-002) until a federated directory lookup exists | | SI-X3 | naming, SI-11 | `trigger-admin` (privacyIDEA) | Legacy account, consumers uninventoried | NK-WP-0049-T22 deleted the unreferenced Kubernetes copy (2026-10-27); revoking the privacyIDEA account stays under CUST-WP-0073-T05 / NK-WP-0055-T06 | | SI-X5 | SI-4, SI-5 | privacyIDEA | Only a local administrator is supported | Upstream support for attributed administrators | +| SI-X6 | SI-3 | LLDAP `svc-provisioner` | LLDAP v0.6.2 has no group narrower than `lldap_admin` that can create users or add members (rehearsal 2026-10-28); own account and Secret, but super-admin rights | A narrower LLDAP role, or a provisioner that no longer creates users (founder decision 2026-10-28) | **Closed:** SI-X4 (OpenBao `netkingdom-platform-admin` bound the group claim only) closed 2026-10-27: the founder applied the `aal2` binding (RPF-WP-0065-T04; receipts show `bound_claims` = `net-kingdom-admins` plus `/assurance/level: aal2`, and a diff --git a/tools/service-identity/declarations/lldap.yaml b/tools/service-identity/declarations/lldap.yaml index a10ae12..6e4a760 100644 --- a/tools/service-identity/declarations/lldap.yaml +++ b/tools/service-identity/declarations/lldap.yaml @@ -81,8 +81,8 @@ identities: status: planned - name: svc-provisioner principal_type: SERVICE - purpose: "Target: identity-provisioner, narrowest working write scope for users and groups, not the super-admin (scope to be tested)" - grants: [{mode: ADMINISTER, scope: "directory/people,groups", activation: STANDING, environments: [PRODUCTION]}] + purpose: "Target: identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)" + grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}] interactive_login: false second_factor: not_applicable custody: [delivered-secret] @@ -99,3 +99,11 @@ exceptions: expires: 2027-01-31 compensating_control: "Web UI restricted by IP allowlist; OTP on the human login" elimination_path: "NK-WP-0054-T05: svc-* binds, a provisioner account, ld-admin as the configured super-admin, admin human-only" + - id: SI-X6 + rules: [SI-3] + identity: svc-provisioner + reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members" + owner: "Founder" + expires: 2027-04-30 + compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist" + elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users" diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index 3a23768..b678112 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -286,6 +286,9 @@ prompt or fd) plus the backup profile and the restore adapters `isolated-lldap.p `isolated-authelia.py`, `isolated-privacyidea-mfa.py`; **(4)** the founder runbook with filled-in commands, a founder-run rehearsal on a restored backup, then the live run. +2026-10-28 founder decision: `svc-provisioner` gets its own account in `lldap_admin`, recorded as +exception SI-X6 (SI-3, expires 2027-04-30) in the standard and `declarations/lldap.yaml`. + ## Disposition of per-service admin accounts ```task