net-kingdom/docs/verification-audit-2026-09-05.md

SSO/MFA verification audit — 2026-09-05

NK-WP-0034-T02. Read-only review of sso-mfa/k8s/verify-t02.sh through verify-t08.sh; no live target was contacted. T06 is the only verifier rewritten in this workplan. The remaining findings are candidates for follow-up work.

Script	Intended property	Actual assertion	Verdict
verify-t02.sh	Working namespaces, isolation, certificate issuance and storage	Named namespaces/policies/issuers exist; selected Ready conditions; optional certificate/storage tests can skip. Label and default StorageClass checks inspect command exit rather than nonempty values.	Insufficient: missing values can pass, network isolation never exercised, storage/certificates can remain unproven.
verify-t03.sh	PostgreSQL usable by privacyIDEA with required database and role	Cluster Ready, running primary, catalog rows for database/role, Secrets and optional scheduled backup resource	Partial: catalog/readiness checks are real but no application credential connection, write/read transaction or restore proof.
verify-t04.sh	Usable privacyIDEA deployment and bootstrap	Running pod, resource names/ports, certificates/PVCs, key files and admin rows; absent keys/admins can be warnings	Insufficient: no authenticated operation or MFA; warning-only gaps return 0.
verify-t05.sh	Integrated LLDAP–Authelia–KeyCape SSO	Readiness, resources and Secret presence, health responses and discovery content	Partial: service availability is checked; LDAP authentication, code exchange, claim correctness and login are not. Warnings can return 0.
verify-t06.sh (before review)	Working realm/resolver and MFA	Realm/resolver existence, list-users response parsed as a dictionary although it is a list, KeyCape token/list endpoint, policies/portal	False-success path: failed admin auth skips core checks, empty user results warn, no MFA validation; warning-only exit is 0.
verify-t06.sh (this revision)	Known user resolves through the realm and validates OTP	Authenticated realm binding, resolver numeric fields, exact user/resolver match, successful TOTP/HOTP result	Automated functional failure matrix passes; attended provider exercise pending. Does not claim complete browser SSO.
verify-t07.sh	User management/self-service and registered clients work	Group/user existence, break-glass membership, portal HTTP, discovery and config fields	Insufficient: auth failure can skip most checks with exit 0; no user lifecycle, enrollment or client login. OpenBao error strings beginning openbao-admin also match the success branch despite validation failure.
verify-t08.sh	Recoverable backups, DR and break-glass readiness	CronJobs/RBAC, prior job success, backup file counts and runbook presence; offsite custody always manual warning	Insufficient: no decryption, restore, recovered application operation or emergency login; warning-only exit 0 does not establish recoverability.

Runbooks must interpret the legacy verifiers as diagnostics until their missing properties are exercised. Existing object checks are useful evidence but cannot close the broader task by themselves.