tegwick
951c7eac2d
security-canon confirmed all five mode readings and found citation errors, now corrected in section 4 and 8 (anti-patterns cited as rules, a MUST resting on a SHOULD, INV-001 for SI-9, SI-15 beyond AUDIT-001). Environment of platform-root, GOVERN for a single-tier service admin (SI-4 allows it), principal_type ownership wording. Records railiance-platform's prepared F-1 and aal2 changes (source only), key-cape's agent token mechanism, glas-harness's harness-launched-only scope and state-hub's attribution design. A hub decision routes ratification and the workers' open choices. No founder decision changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
58 lines
2.7 KiB
YAML
58 lines
2.7 KiB
YAML
schema_version: "0.1"
|
|
service: privacyidea
|
|
owner: "MFA and privacyIDEA owners (NetKingdom)"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [sso-mfa/k8s/privacyidea/README.md, sso-mfa/k8s/privacyidea/bootstrap-admin.py, sso-mfa/k8s/keycape/deployment.yaml, docs/service-identity-inventory.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: pi-admin
|
|
principal_type: HUMAN
|
|
conventions: [service-admin]
|
|
purpose: "privacyIDEA's local administrator; policy pi-admin-all-rights restricted to adminuser=pi-admin"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: privacyidea, activation: STANDING, environments: [PRODUCTION]}
|
|
- {mode: GOVERN, scope: privacyidea, activation: STANDING, environments: [PRODUCTION], note: "pi-admin-all-rights can set the policies that bound other admins"}
|
|
interactive_login: true
|
|
second_factor: unknown
|
|
custody: [personal-safe]
|
|
consumers: [{name: founder, kind: person}]
|
|
owner: "Founder and MFA owners"
|
|
rotation: {path: "bootstrap-admin custody entry; password changes are a separate procedure", coupling: []}
|
|
status: active
|
|
recovery: {needed: true, works_with_sso_down: true, in_crisis_list: true}
|
|
- name: trigger-admin
|
|
principal_type: unknown
|
|
conventions: [service-admin]
|
|
purpose: "Legacy Keycloak-era administrator account, policy and Secret; who presents it is not established"
|
|
grants: [{mode: ADMINISTER, scope: privacyidea, activation: STANDING, environments: [PRODUCTION]}]
|
|
interactive_login: false
|
|
second_factor: unknown
|
|
custody: [delivered-secret]
|
|
consumers: []
|
|
owner: "MFA owners; revocation decided under NK-WP-0049-T22"
|
|
rotation: {path: "None established; revocation needs a separate approval", coupling: []}
|
|
status: legacy
|
|
disposition: {action: defer, owner: "Founder", date: 2026-12-31}
|
|
- name: keycape-factor-reader
|
|
principal_type: SERVICE
|
|
purpose: "KeyCape's access to read factor state; delivered by railiance-platform (RPF-WP-0040)"
|
|
grants: [{mode: unknown, scope: privacyidea, note: "exact rights not established"}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: keycape, kind: service}]
|
|
owner: "railiance-platform and key-cape"
|
|
rotation: {path: "Renewed by policy keycape-factor-renewer through ESO", coupling: [keycape]}
|
|
status: active
|
|
exceptions:
|
|
- id: SI-X3
|
|
rules: [NAMING]
|
|
identity: trigger-admin
|
|
reason: "Legacy account whose name does not follow the admin naming form and whose consumers are uninventoried"
|
|
owner: "Founder"
|
|
expires: 2026-12-31
|
|
compensating_control: "Not provisioned by the current bootstrap"
|
|
elimination_path: "Revocation or acceptance under NK-WP-0049-T22"
|