tegwick
1fbebb2d94
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
59 lines
2.5 KiB
YAML
59 lines
2.5 KiB
YAML
spec: runbook-pack/v0.2
|
|
id: nk.privacyidea-realm-repair
|
|
title: privacyIDEA realm repair
|
|
owner: net-kingdom
|
|
outcome: The coulomb realm, LLDAP resolver and self-service policies exist again, and platform-root TOTP is enrolled in the repaired realm.
|
|
engine: native
|
|
framing:
|
|
- Passwords are entered at the script's prompts only; never on a command line, in chat or in a file.
|
|
- Ported from the security bootstrap console runbook "privacyIDEA realm repair".
|
|
actors:
|
|
- id: identity-admin
|
|
role: Identity admin
|
|
description: Holds the pi-admin and LLDAP bind passwords and runs the attended repair.
|
|
privileges: [privacyidea-admin, lldap-bind]
|
|
datapoints:
|
|
- id: realm_repaired
|
|
label: Realm repaired and verified
|
|
type: enum
|
|
values: ["yes", "no"]
|
|
default: "no"
|
|
dimensions: {actor: identity-admin, kind: state, subsystem: privacyIDEA}
|
|
ask_in: repair
|
|
stages:
|
|
- id: repair
|
|
title: Repair the realm
|
|
goal: The realm, resolver and policies are recreated and the T06 verification passes.
|
|
steps:
|
|
- id: run-repair
|
|
title: Run the attended realm repair
|
|
actor: identity-admin
|
|
owner: privacyIDEA
|
|
description: Prompts for the pi-admin and LLDAP bind passwords, recreates the realm, resolver, self-enrollment and passthrough policies, then runs T06 verification. Passwords stay in a private temp directory removed on exit.
|
|
command: bash sso-mfa/k8s/privacyidea/repair-realm-live.sh
|
|
idempotent: idempotent
|
|
idempotent_note: Recreates the same objects; safe to rerun.
|
|
auto_confirm: manual-only
|
|
verify:
|
|
done_when: The script's T06 verification reports success
|
|
expect: manual
|
|
- id: reenroll-totp
|
|
title: Enroll or re-enroll platform-root TOTP
|
|
actor: identity-admin
|
|
owner: privacyIDEA
|
|
requires: [run-repair]
|
|
description: In privacyIDEA self-service, log in as platform-root and enroll TOTP in the repaired realm. Record the recovery codes in the platform-root safe entry, not here.
|
|
idempotent: non-idempotent
|
|
rollback: Delete the token in self-service and enroll again.
|
|
verify:
|
|
done_when: platform-root can log in with a TOTP code
|
|
expect: manual
|
|
gates:
|
|
- id: realm-usable
|
|
title: The repaired realm is usable
|
|
goal: recoverable-identity
|
|
blocking: true
|
|
downstream_risk: Logins that need MFA fail for every user of the realm.
|
|
checks:
|
|
- done_when: The T06 verification passed and platform-root TOTP works
|
|
expect: manual
|