schema_version: "0.1"
service: lldap
owner: "NetKingdom directory and User Engine owners"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [docs/service-identity-inventory.md, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, sso-mfa/k8s/privacyidea/realm_bootstrap.py, sso-mfa/k8s/identity-provisioner/deployment.yaml, sso-mfa/k8s/lldap/OPERATOR-GROUPS.md]
  owner_confirmed: false
complete: false
identities:
  - name: admin
    principal_type: HUMAN
    purpose: "The human platform administrator; directory rights through lldap_admin on its own password and OTP; no service binds as admin (bind split 2026-10-30)"
    grants:
      - {mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin membership"}
    interactive_login: true
    second_factor: required
    custody: [personal-safe]
    consumers:
      - {name: founder, kind: person}
    owner: "NetKingdom directory and User Engine owners"
    rotation:
      path: "Human password change; no service Secret holds it"
      coupling: []
    status: active
    recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
  - name: ld-admin
    principal_type: HUMAN
    conventions: [service-admin]
    purpose: "LLDAP only: the directory's configured super-admin (LLDAP_LDAP_USER_DN), a sealed fallback; introduced 2026-10-30"
    grants:
      - {mode: ADMINISTER, scope: lldap, activation: BREAK_GLASS, environments: [PRODUCTION]}
    interactive_login: true
    second_factor: unknown
    custody: [delivered-secret, offline-key]
    consumers: []
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "LLDAP_LDAP_USER_PASS in lldap-secrets and the LLDAP custody file (apply-service-secrets.py named rotation)", coupling: [lldap]}
    status: active
  - name: svc-authelia
    principal_type: SERVICE
    conventions: [bind]
    purpose: "Authelia's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: authelia, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with Authelia only", coupling: [authelia]}
    status: active
  - name: svc-keycape
    principal_type: SERVICE
    conventions: [bind]
    purpose: "KeyCape's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: keycape, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with KeyCape only", coupling: [keycape]}
    status: active
  - name: svc-privacyidea
    principal_type: SERVICE
    conventions: [bind]
    purpose: "The privacyIDEA resolver's read-only directory lookup"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: privacyidea, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Resolver bind password, stored encrypted in the privacyIDEA database", coupling: [privacyidea]}
    status: active
  - name: svc-provisioner
    principal_type: SERVICE
    purpose: "identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)"
    grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: identity-provisioner, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Secret rotation with the provisioner only", coupling: [identity-provisioner]}
    status: active
  - name: syn-journey
    principal_type: SERVICE
    purpose: "Synthetic MFA sign-in journey (NK-WP-0056-T09): signs in through KeyCape, Authelia and privacyIDEA so a bounded executor can check sign-in between consumers without a person; no groups, no rights; KeyCape tokens still say principal_type human"
    grants: [{mode: USE, scope: sign-in, activation: STANDING, environments: [PRODUCTION], note: "no group: reaches no protected service"}]
    interactive_login: true
    second_factor: required
    custody: [openbao-lease]
    consumers: [{name: synthetic-journey, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "lane.py teardown then setup (CCR-2026-0057); password and TOTP seed together", coupling: [privacyidea]}
    status: planned
exceptions:
  - id: SI-X6
    rules: [SI-3]
    identity: svc-provisioner
    reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members"
    owner: "Founder"
    expires: 2027-04-30
    compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist"
    elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users"