tegwick
a3bab9210b
Founder clarifications: the SI-14 token ceiling is 60 minutes (3600 s); ld-admin is for LLDAP only and the name admin remains the human platform administrator's wherever it appears. The LLDAP rehearsal is now introducing ld-admin by configuration and demoting admin, not renaming. The validator rejects a service-admin named admin. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
92 lines
4.1 KiB
YAML
92 lines
4.1 KiB
YAML
schema_version: "0.1"
|
|
service: lldap
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [docs/service-identity-inventory.md, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, sso-mfa/k8s/privacyidea/realm_bootstrap.py, sso-mfa/k8s/identity-provisioner/deployment.yaml, sso-mfa/k8s/lldap/OPERATOR-GROUPS.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: admin
|
|
classes: [human, bind, service-admin]
|
|
purpose: "Human platform administrator and, with the same password, the directory super-admin and the bind of four services"
|
|
privilege_level: admin
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [delivered-secret, personal-safe]
|
|
consumers:
|
|
- {name: founder, kind: person}
|
|
- {name: authelia, kind: service}
|
|
- {name: keycape, kind: service}
|
|
- {name: privacyidea, kind: service}
|
|
- {name: identity-provisioner, kind: service}
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation:
|
|
path: "LLDAP_LDAP_USER_PASS in lldap-secrets (Credential Management section 6)"
|
|
coupling: [authelia, keycape, privacyidea-resolver, identity-provisioner, lldap-web-ui]
|
|
status: active
|
|
recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
|
|
- name: ld-admin
|
|
classes: [service-admin]
|
|
purpose: "LLDAP only: the directory's configured super-admin, separate from every bind and every person; introduced by configuration after a rehearsal"
|
|
privilege_level: admin
|
|
interactive_login: true
|
|
second_factor: unknown
|
|
custody: [unknown]
|
|
consumers: []
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "To be decided in NK-WP-0054-T06", coupling: []}
|
|
status: planned
|
|
- name: svc-authelia
|
|
classes: [bind]
|
|
purpose: "Target: Authelia's read-only directory lookup"
|
|
privilege_level: read
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: authelia, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with Authelia only", coupling: [authelia]}
|
|
status: planned
|
|
- name: svc-keycape
|
|
classes: [bind]
|
|
purpose: "Target: KeyCape's read-only directory lookup"
|
|
privilege_level: read
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: keycape, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with KeyCape only", coupling: [keycape]}
|
|
status: planned
|
|
- name: svc-privacyidea
|
|
classes: [bind]
|
|
purpose: "Target: the privacyIDEA resolver's read-only directory lookup"
|
|
privilege_level: read
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: privacyidea, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Resolver bind password, stored encrypted in the privacyIDEA database", coupling: [privacyidea]}
|
|
status: planned
|
|
- name: svc-provisioner
|
|
classes: [workload]
|
|
purpose: "Target: identity-provisioner, narrowest working write scope for users and groups, not the super-admin (scope to be tested)"
|
|
privilege_level: write_scoped
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: identity-provisioner, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with the provisioner only", coupling: [identity-provisioner]}
|
|
status: planned
|
|
exceptions:
|
|
- id: SI-X1
|
|
rules: [SI-1, SI-2, SI-3, SI-9, NAMING]
|
|
identity: admin
|
|
reason: "One account is the human, the super-admin and the shared bind of four services, and its password is in a person's safe and in a Kubernetes Secret"
|
|
owner: "Founder"
|
|
expires: 2027-01-31
|
|
compensating_control: "Web UI restricted by IP allowlist; OTP on the human login; NK-WP-0054-T05 removes the sharing"
|