tegwick
ac66753bd4
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported principal_type and authority grants MODE @ SCOPE with activation and environments, estate conventions bind and service-admin, unknown placeholders, and an elimination path on every exception. SI-4 and SI-7 became decidable. Before/after over the same declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/ conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is established. lldap/admin is now also excepted under SI-4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
101 lines
4.9 KiB
YAML
101 lines
4.9 KiB
YAML
schema_version: "0.1"
|
|
service: lldap
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [docs/service-identity-inventory.md, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, sso-mfa/k8s/privacyidea/realm_bootstrap.py, sso-mfa/k8s/identity-provisioner/deployment.yaml, sso-mfa/k8s/lldap/OPERATOR-GROUPS.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: admin
|
|
principal_type: HUMAN
|
|
conventions: [bind, service-admin]
|
|
purpose: "The human platform administrator; with the same password also the directory super-admin and the bind of four services"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION]}
|
|
- {mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true, note: "service binds"}
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [delivered-secret, personal-safe]
|
|
consumers:
|
|
- {name: founder, kind: person}
|
|
- {name: authelia, kind: service}
|
|
- {name: keycape, kind: service}
|
|
- {name: privacyidea, kind: service}
|
|
- {name: identity-provisioner, kind: service}
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation:
|
|
path: "LLDAP_LDAP_USER_PASS in lldap-secrets (Credential Management section 6)"
|
|
coupling: [authelia, keycape, privacyidea-resolver, identity-provisioner, lldap-web-ui]
|
|
status: active
|
|
recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
|
|
- name: ld-admin
|
|
principal_type: HUMAN
|
|
conventions: [service-admin]
|
|
purpose: "LLDAP only: the directory's configured super-admin, a sealed fallback; introduced by configuration after a rehearsal"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: lldap, activation: BREAK_GLASS, environments: [PRODUCTION]}
|
|
interactive_login: true
|
|
second_factor: unknown
|
|
custody: [unknown]
|
|
consumers: []
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "To be decided in NK-WP-0054-T06", coupling: []}
|
|
status: planned
|
|
- name: svc-authelia
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "Target: Authelia's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: authelia, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with Authelia only", coupling: [authelia]}
|
|
status: planned
|
|
- name: svc-keycape
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "Target: KeyCape's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: keycape, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with KeyCape only", coupling: [keycape]}
|
|
status: planned
|
|
- name: svc-privacyidea
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "Target: the privacyIDEA resolver's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: privacyidea, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Resolver bind password, stored encrypted in the privacyIDEA database", coupling: [privacyidea]}
|
|
status: planned
|
|
- name: svc-provisioner
|
|
principal_type: SERVICE
|
|
purpose: "Target: identity-provisioner, narrowest working write scope for users and groups, not the super-admin (scope to be tested)"
|
|
grants: [{mode: ADMINISTER, scope: "directory/people,groups", activation: STANDING, environments: [PRODUCTION]}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: identity-provisioner, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with the provisioner only", coupling: [identity-provisioner]}
|
|
status: planned
|
|
exceptions:
|
|
- id: SI-X1
|
|
rules: [SI-1, SI-2, SI-3, SI-4, SI-9, NAMING]
|
|
identity: admin
|
|
reason: "One account is the human, the super-admin and the shared bind of four services, and its password is in a person's safe and in a Kubernetes Secret"
|
|
owner: "Founder"
|
|
expires: 2027-01-31
|
|
compensating_control: "Web UI restricted by IP allowlist; OTP on the human login"
|
|
elimination_path: "NK-WP-0054-T05: svc-* binds, a provisioner account, ld-admin as the configured super-admin, admin human-only"
|