coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md
tegwick ab25dde80d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
security: repair LDAP group callers and fail incomplete T07 acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
2026-10-14 01:17:35 +02:00

3.4 KiB
Raw Blame History

Operator groups — membership runbook

Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See procedure inventory.

Least-privilege app-scoped LLDAP groups that gate browser SSO via Authelia domain rules. Distinct from platform groups (net-kingdom-users / net-kingdom-admins).

Groups

Group Gates (Authelia) Who belongs
activity-core-operators activity.coulomb.social, temporal.coulomb.social Named founders / platform operators who need the activity-core ops console or Temporal UI

Do not auto-add everyone in net-kingdom-admins. Membership is a conscious grant. Platform admin ≠ activity-core operator.

Group bootstrap uses explicit custody and reviewed preview/apply. Only missing empty baseline groups are created; native estate acceptance remains NK-WP-0049-T03. Authelia config: sso-mfa/k8s/authelia/configmap.yaml (access_control.rules).

WebUI path

  1. Open https://lldap.coulomb.social (IP-restricted admin UI).
  2. Sign in as admin (password from KeePassXC / custody — never commit it).
  3. Groups → activity-core-operators → add or remove members.
  4. User must already exist through governed User Engine / identity-provisioner onboarding; see current owner routes.
  5. User re-authenticates at Authelia if an old session lacks the group claim (sign out / new browser session).

Scripted path

Use group maintenance with explicit private custody. For an existing identity and app-scoped group, manage-group-members.sh add or remove previews an exact change; apply requires its reviewed snapshot digest. list is read-only. Tenant/platform/LLDAP administrative groups are refused. No Kubernetes Secret extraction or shell-export step is required. Existing live authority and protected execution remain required; the source adapter grants none.

Onboarding checklist (activity-core ops)

  1. User has LLDAP account and is in net-kingdom-users (normal onboarding).
  2. Operator adds them to activity-core-operators (attended WebUI or reviewed group adapter under existing authority).
  3. User signs in at https://auth.coulomb.social (password; MFA via KeyCape path when using OIDC apps — ForwardAuth to ops hosts uses Authelia session).
  4. Open https://activity.coulomb.social and https://temporal.coulomb.social — both should pass only for group members.
  5. Offboard: remove from activity-core-operators first; full account offboard remains the platform lifecycle path.

Break-glass (independent of this group)

activity-core ClusterIP port-forward + ACTIVITY_CORE_OPERATOR_TOKEN does not use Authelia groups. Documented in activity-core runbooks. Keep that path for SSO outages; do not gate break-glass on LLDAP group membership.

Adding a future app-operator group

  1. Have the service/IAM owner establish its app-scoped group through the existing provider or attended UI. The fixed baseline bootstrap is not a registry for new apps.
  2. Document it in this table.
  3. Add Authelia domain rules (member one_factor + domain deny fallback) in sso-mfa/k8s/authelia/configmap.yaml — see Authelia README.
  4. Never invent a KeyCape OIDC client solely for Traefik ForwardAuth apps.