schema_version: "0.1"
service: lldap
owner: "NetKingdom directory and User Engine owners"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [docs/service-identity-inventory.md, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, sso-mfa/k8s/privacyidea/realm_bootstrap.py, sso-mfa/k8s/identity-provisioner/deployment.yaml, sso-mfa/k8s/lldap/OPERATOR-GROUPS.md]
  owner_confirmed: false
complete: false
identities:
  - name: admin
    principal_type: HUMAN
    conventions: [bind, service-admin]
    purpose: "The human platform administrator; with the same password also the directory super-admin and the bind of four services"
    grants:
      - {mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION]}
      - {mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true, note: "service binds"}
    interactive_login: true
    second_factor: required
    custody: [delivered-secret, personal-safe]
    consumers:
      - {name: founder, kind: person}
      - {name: authelia, kind: service}
      - {name: keycape, kind: service}
      - {name: privacyidea, kind: service}
      - {name: identity-provisioner, kind: service}
    owner: "NetKingdom directory and User Engine owners"
    rotation:
      path: "LLDAP_LDAP_USER_PASS in lldap-secrets (Credential Management section 6)"
      coupling: [authelia, keycape, privacyidea-resolver, identity-provisioner, lldap-web-ui]
    status: active
    recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
  - name: ld-admin
    principal_type: HUMAN
    conventions: [service-admin]
    purpose: "LLDAP only: the directory's configured super-admin, a sealed fallback; introduced by configuration after a rehearsal"
    grants:
      - {mode: ADMINISTER, scope: lldap, activation: BREAK_GLASS, environments: [PRODUCTION]}
    interactive_login: true
    second_factor: unknown
    custody: [unknown]
    consumers: []
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "To be decided in NK-WP-0054-T06", coupling: []}
    status: planned
  - name: svc-authelia
    principal_type: SERVICE
    conventions: [bind]
    purpose: "Target: Authelia's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: authelia, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with Authelia only", coupling: [authelia]}
    status: planned
  - name: svc-keycape
    principal_type: SERVICE
    conventions: [bind]
    purpose: "Target: KeyCape's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: keycape, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with KeyCape only", coupling: [keycape]}
    status: planned
  - name: svc-privacyidea
    principal_type: SERVICE
    conventions: [bind]
    purpose: "Target: the privacyIDEA resolver's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: privacyidea, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Resolver bind password, stored encrypted in the privacyIDEA database", coupling: [privacyidea]}
    status: planned
  - name: svc-provisioner
    principal_type: SERVICE
    purpose: "Target: identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)"
    grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: identity-provisioner, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with the provisioner only", coupling: [identity-provisioner]}
    status: planned
exceptions:
  - id: SI-X1
    rules: [SI-1, SI-2, SI-3, SI-4, SI-9, NAMING]
    identity: admin
    reason: "One account is the human, the super-admin and the shared bind of four services, and its password is in a person's safe and in a Kubernetes Secret"
    owner: "Founder"
    expires: 2027-01-31
    compensating_control: "Web UI restricted by IP allowlist; OTP on the human login"
    elimination_path: "NK-WP-0054-T05: svc-* binds, a provisioner account, ld-admin as the configured super-admin, admin human-only"
  - id: SI-X6
    rules: [SI-3]
    identity: svc-provisioner
    reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members"
    owner: "Founder"
    expires: 2027-04-30
    compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist"
    elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users"