tegwick
4e07d60ff1
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd
20 lines
3.1 KiB
Markdown
20 lines
3.1 KiB
Markdown
# SSO/MFA verification audit — 2026-09-05
|
||
|
||
NK-WP-0034-T02. Read-only review of `sso-mfa/k8s/verify-t02.sh` through
|
||
`verify-t08.sh`; no live target was contacted. T06 is the only verifier rewritten
|
||
in this workplan. The remaining findings are candidates for follow-up work.
|
||
|
||
| Script | Intended property | Actual assertion | Verdict |
|
||
| --- | --- | --- | --- |
|
||
| `verify-t02.sh` | Working namespaces, isolation, certificate issuance and storage | Named namespaces/policies/issuers exist; selected Ready conditions; optional certificate/storage tests can skip. Label and default StorageClass checks inspect command exit rather than nonempty values. | Insufficient: missing values can pass, network isolation never exercised, storage/certificates can remain unproven. |
|
||
| `verify-t03.sh` | PostgreSQL usable by privacyIDEA with required database and role | Cluster Ready, running primary, catalog rows for database/role, Secrets and optional scheduled backup resource | Partial: catalog/readiness checks are real but no application credential connection, write/read transaction or restore proof. |
|
||
| `verify-t04.sh` | Usable privacyIDEA deployment and bootstrap | Running pod, resource names/ports, certificates/PVCs, key files and admin rows; absent keys/admins can be warnings | Insufficient: no authenticated operation or MFA; warning-only gaps return 0. |
|
||
| `verify-t05.sh` | Integrated LLDAP–Authelia–KeyCape SSO | Readiness, resources and Secret presence, health responses and discovery content | Partial: service availability is checked; LDAP authentication, code exchange, claim correctness and login are not. Warnings can return 0. |
|
||
| `verify-t06.sh` (before review) | Working realm/resolver and MFA | Realm/resolver existence, list-users response parsed as a dictionary although it is a list, KeyCape token/list endpoint, policies/portal | False-success path: failed admin auth skips core checks, empty user results warn, no MFA validation; warning-only exit is 0. |
|
||
| `verify-t06.sh` (this revision) | Known user resolves through the realm and validates OTP | Authenticated realm binding, resolver numeric fields, exact user/resolver match, successful TOTP/HOTP result | Automated functional failure matrix passes; attended provider exercise pending. Does not claim complete browser SSO. |
|
||
| `verify-t07.sh` | User management/self-service and registered clients work | Group/user existence, break-glass membership, portal HTTP, discovery and config fields | Insufficient: auth failure can skip most checks with exit 0; no user lifecycle, enrollment or client login. OpenBao error strings beginning `openbao-admin` also match the success branch despite validation failure. |
|
||
| `verify-t08.sh` | Recoverable backups, DR and break-glass readiness | CronJobs/RBAC, prior job success, backup file counts and runbook presence; offsite custody always manual warning | Insufficient: no decryption, restore, recovered application operation or emergency login; warning-only exit 0 does not establish recoverability. |
|
||
|
||
Runbooks must interpret the legacy verifiers as diagnostics until their missing
|
||
properties are exercised. Existing object checks are useful evidence but cannot
|
||
close the broader task by themselves.
|