tegwick
aeb7fd81f4
A lldap_strict_readonly account changes its own password with its own token on the pinned LLDAP and cannot change another account's, so the pilot needs no lldap_password_manager account (secrets-engine Q2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87 |
||
|---|---|---|
| .. | ||
| README.md | ||
LLDAP bind self-rotation on the pinned image (NK-WP-0056, 2026-10-31)
Agent-run, synthetic: a throwaway LLDAP on the pinned production image
(docker.io/lldap/lldap@sha256:9e605a66…d09d), published on 127.0.0.1, tmpfs data, generated values, removed afterwards.
Prompted by secrets-engine's T02 answer (docs/bounded-executor-credential-lanes.md, Q2 preferred shape).
| Step | Result |
|---|---|
svc-x created in lldap_strict_readonly (the bind accounts' group), password set by admin |
— |
svc-x signs in with its password |
yes |
lldap_set_password for svc-x with svc-x's own token |
rc 0 |
| new password signs in / old password signs in | yes / no |
lldap_set_password for admin with svc-x's token |
refused (rc 1); admin unchanged |
Consequence: the T06 rotation can change svc-authelia's password as svc-authelia itself, using the current value
the executor reads from OpenBao, with no lldap_password_manager account (svc-executor-pw in
tools/service-identity/declarations/bounded-executor.yaml). A leaked executor token then reaches one bind, not every
non-admin user. Revert is the same operation with the previous value. Founder decision pending (secrets-engine Q2).