coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md
tegwick 84c5dbeec8
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
security: retire unsafe legacy LDAP lifecycle callers 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
2026-10-14 00:08:42 +02:00

3.2 KiB
Raw Blame History

Operator groups — membership runbook

Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See procedure inventory.

Least-privilege app-scoped LLDAP groups that gate browser SSO via Authelia domain rules. Distinct from platform groups (net-kingdom-users / net-kingdom-admins).

Groups

Group Gates (Authelia) Who belongs
activity-core-operators activity.coulomb.social, temporal.coulomb.social Named founders / platform operators who need the activity-core ops console or Temporal UI

Do not auto-add everyone in net-kingdom-admins. Membership is a conscious grant. Platform admin ≠ activity-core operator.

Group bootstrap via bootstrap-users.sh remains under credential-path repair in NK-WP-0049; it is not accepted by the lifecycle retirement tests. Authelia config: sso-mfa/k8s/authelia/configmap.yaml (access_control.rules).

WebUI path

  1. Open https://lldap.coulomb.social (IP-restricted admin UI).
  2. Sign in as admin (password from KeePassXC / custody — never commit it).
  3. Groups → activity-core-operators → add or remove members.
  4. User must already exist through governed User Engine / identity-provisioner onboarding; see current owner routes.
  5. User re-authenticates at Authelia if an old session lacks the group claim (sign out / new browser session).

Scripted path pending repair

manage-group-members.sh still has a legacy admin-credential path. Its repair and native verification remain in NK-WP-0049-T02/T03. The earlier automatic Kubernetes Secret extraction and shell-export instructions are withdrawn. Use the existing attended operator UI under the caller's established authority; this document grants no new credential or group-administration permission.

Onboarding checklist (activity-core ops)

  1. User has LLDAP account and is in net-kingdom-users (normal onboarding).
  2. Operator adds them to activity-core-operators (attended WebUI under existing authority).
  3. User signs in at https://auth.coulomb.social (password; MFA via KeyCape path when using OIDC apps — ForwardAuth to ops hosts uses Authelia session).
  4. Open https://activity.coulomb.social and https://temporal.coulomb.social — both should pass only for group members.
  5. Offboard: remove from activity-core-operators first; full account offboard remains the platform lifecycle path.

Break-glass (independent of this group)

activity-core ClusterIP port-forward + ACTIVITY_CORE_OPERATOR_TOKEN does not use Authelia groups. Documented in activity-core runbooks. Keep that path for SSO outages; do not gate break-glass on LLDAP group membership.

Adding a future app-operator group

  1. Add the group name to REQUIRED_GROUPS in bootstrap-users.sh.
  2. Document it in this table.
  3. Add Authelia domain rules (member one_factor + domain deny fallback) in sso-mfa/k8s/authelia/configmap.yaml — see Authelia README.
  4. Never invent a KeyCape OIDC client solely for Traefik ForwardAuth apps.