tegwick
ab25dde80d
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
71 lines
4.9 KiB
Markdown
71 lines
4.9 KiB
Markdown
# Legacy LLDAP lifecycle retirement
|
||
|
||
Effective 2026-10-14; source reconciliation under NK-WP-0049-T02.
|
||
|
||
The three commands below now exit 2 before inspecting arguments, discovering
|
||
credentials, or calling any external program. Their old arguments are ignored.
|
||
The two Make targets and three console commands also refuse execution. No
|
||
account, membership, password, token or deployed workload is changed by this
|
||
source retirement. Existing credentials are not revoked.
|
||
|
||
| Retired command | Why withdrawn | Owner route |
|
||
| --- | --- | --- |
|
||
| `sso-mfa/k8s/lldap/create-user.sh` | Direct creation bypassed governed lifecycle/linking; test mode used predictable passwords; admin credentials were sourced or discovered and passed through unsafe shell paths. | Ordinary onboarding through User Engine and the existing identity-provisioner. Platform-root bootstrap remains a separate reviewed IAM procedure. |
|
||
| `sso-mfa/k8s/lldap/dry-run-nonroot-user.sh` | The “dry-run” mutated real users and passwords; pattern cleanup lacked creation provenance; generated evidence overstated verification. | An explicitly scoped owner lifecycle trial with exact created-identity receipts and actual consumer checks. |
|
||
| `sso-mfa/k8s/lldap/break-glass.sh` | Repeated execution could overwrite credentials and depended on an unsupported password GraphQL mutation. This is not an accepted provider recovery path. | Preserve existing offline custody; obtain the IAM owner's exact recovery procedure and native independent-recovery evidence under NK-WP-0049-T03. |
|
||
|
||
## Ordinary onboarding and lifecycle
|
||
|
||
Use the existing [public registration contract](public-registration-orchestration-contract.md):
|
||
User Engine orchestrates mailbox verification for an admitted client/tenant,
|
||
links the canonical subject, and invokes identity-provisioner. The IAM provider
|
||
owns the single-use password-setup handoff. A fresh KeyCape login establishes the
|
||
application session. No predictable password or direct administrative shell
|
||
creation is a substitute. Completed NK-WP-0025 and NK-WP-0038 record earlier
|
||
registration and scoped tenant-access delivery; those receipts do not establish
|
||
current deployment availability. Check the owner’s current service and contract
|
||
before a trial; this document does not introduce a new provisioning API.
|
||
|
||
The [User Engine boundary contract](../canon/standards/user-engine-boundary-contract_v0.1.md)
|
||
keeps domain accounts/product memberships in User Engine and coarse authentication
|
||
groups, passwords and MFA in IAM. Protected lifecycle mutations require the
|
||
existing authorization path. Tenant-access changes must preserve other tenants,
|
||
the global identity and unrelated suspension state. Group removal alone does not
|
||
prove global lockout or session revocation. Public registration cannot create a
|
||
platform-root or platform-admin identity.
|
||
|
||
## Evidence and cleanup
|
||
|
||
The console's `lifecycle-flow-template` and `onboarding-dry-run-template` now
|
||
produce blank worksheets with false assurances. Fill them only from actual
|
||
owner/consumer results. Their existing validators check structure and assertions;
|
||
a valid document is not independent proof that a native operation happened.
|
||
Historic evidence is retained as historic evidence.
|
||
|
||
For an authorized trial, retain exact subject/tenant/client identifiers and
|
||
creation provenance, actual issued-claims and effective-access observations,
|
||
negative access tests, and the disposition of the exact test identity and its
|
||
sessions/credentials. Retain non-secret receipt references, never token or
|
||
password values. Do not infer issued claims from a directory group list or delete
|
||
accounts selected by a name pattern. Resource transfer and cross-tenant effects
|
||
must be resolved through the lifecycle owner before offboarding.
|
||
|
||
## Recovery and remaining work
|
||
|
||
Keep the existing break-glass account and offline custody material until the
|
||
owner explicitly authorizes a change. This retirement neither rotates its
|
||
password nor proves it works independently of a failed identity provider.
|
||
Disabling MFA is not evidence of independent recovery. The provider dependency
|
||
limitation was already recorded in
|
||
[the KeyCape exposure map](../history/2026-08-23-keycape-exposure-dependency-map.md).
|
||
NK-WP-0049-T03 still needs the exact owner-approved recovery ceremony, separated
|
||
key/snapshot custody, failed-key refusal, native restore and cleanup receipts.
|
||
|
||
The remaining LDAP group entry points now use the
|
||
[explicit-input maintenance adapter](../sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md)
|
||
under NK-WP-0049-T02. Group bootstrap creates only missing empty baseline groups;
|
||
service membership requires a reviewed preview and exact readback. T07 reports
|
||
structure with a nonzero incomplete exit and never reads the KeyCape config Secret.
|
||
Source and isolated native tests do not establish estate acceptance. Incident
|
||
cutover helpers, full caller/root-output inventory and owner-approved independent
|
||
recovery remain open. This retirement does not close NK-WP-0049.
|