{
  "schema": "coulomb.native-reset-authority-matrix.v1",
  "observed_at": "2026-10-31T12:37:24.533367+00:00",
  "data": "synthetic",
  "status": "native_authority_matrix_verified",
  "images": {
    "lldap": "sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d",
    "authelia": "sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54",
    "client": "sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd"
  },
  "production_access": false,
  "provider_smtp_contacted": false,
  "owner_runtime_or_permission_change_performed": false,
  "no_ports_host_mounts_or_external_routes": true,
  "backend_container_flags_verified_before_fixture_import": true,
  "source_manifest_sha256": "c982e3a47d9e3aec5095a3c11fea7260fd4f5cb6db57b827b915988b432a18d0",
  "target_classes": {
    "alice": "ordinary user",
    "bob": "other ordinary user",
    "operator": "lldap_admin member",
    "appoperator": "application-admins member, not lldap_admin",
    "svc-other": "other service, lldap_strict_readonly"
  },
  "findings": {
    "scenarios": [
      {
        "bind_role": "lldap_strict_readonly",
        "directory_writes": {
          "positive_controls": 7,
          "refused_mutations": [
            "create_user",
            "edit_other_user",
            "delete_user",
            "create_group",
            "delete_group",
            "self_promote_admin",
            "remove_admin_membership"
          ],
          "directory_metadata_unchanged": true
        },
        "direct_password_changes": [
          {
            "target": "alice",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          },
          {
            "target": "bob",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          },
          {
            "target": "operator",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          },
          {
            "target": "appoperator",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          },
          {
            "target": "svc-other",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          }
        ],
        "authelia_resets": [
          {
            "target": "alice",
            "status": "reset_refused",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": "KO",
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": true,
            "new_password_accepted_after": false
          },
          {
            "target": "bob",
            "status": "reset_refused",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": "KO",
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": true,
            "new_password_accepted_after": false
          },
          {
            "target": "operator",
            "status": "reset_refused",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": "KO",
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": true,
            "new_password_accepted_after": false
          },
          {
            "target": "appoperator",
            "status": "reset_refused",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": "KO",
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": true,
            "new_password_accepted_after": false
          }
        ]
      },
      {
        "bind_role": "lldap_password_manager",
        "directory_writes": {
          "positive_controls": 7,
          "refused_mutations": [
            "create_user",
            "edit_other_user",
            "delete_user",
            "create_group",
            "delete_group",
            "self_promote_admin",
            "remove_admin_membership"
          ],
          "directory_metadata_unchanged": true
        },
        "direct_password_changes": [
          {
            "target": "alice",
            "password_changed": true,
            "old_password_accepted": false,
            "new_password_accepted": true
          },
          {
            "target": "bob",
            "password_changed": true,
            "old_password_accepted": false,
            "new_password_accepted": true
          },
          {
            "target": "operator",
            "password_changed": false,
            "old_password_accepted": true,
            "new_password_accepted": false
          },
          {
            "target": "appoperator",
            "password_changed": true,
            "old_password_accepted": false,
            "new_password_accepted": true
          },
          {
            "target": "svc-other",
            "password_changed": true,
            "old_password_accepted": false,
            "new_password_accepted": true
          }
        ],
        "authelia_resets": [
          {
            "target": "alice",
            "status": "reset_completed",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": null,
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": false,
            "new_password_accepted_after": true
          },
          {
            "target": "bob",
            "status": "reset_completed",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": null,
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": false,
            "new_password_accepted_after": true
          },
          {
            "target": "operator",
            "status": "reset_refused",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": "KO",
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": true,
            "new_password_accepted_after": false
          },
          {
            "target": "appoperator",
            "status": "reset_completed",
            "only_loopback_interface": true,
            "external_routes_absent": true,
            "old_password_initially_accepted": true,
            "new_password_initially_refused": true,
            "native_first_factor": true,
            "interactive_service_login_refused": true,
            "reset_http_status": 200,
            "reset_response_status": null,
            "native_identity_finish": true,
            "reset_without_verified_challenge_refused": true,
            "consumed_identity_token_replay_refused": true,
            "old_password_accepted_after": false,
            "new_password_accepted_after": true
          }
        ]
      }
    ],
    "cleanup_verified": true
  }
}