tegwick
436c5fe585
All five NK-WP-0053 stages passed on generation 20261031T034845Z-a13dc92e2c61, the first capture after the 2026-10-30 bind split, operated by admin. Uncounted attempts are kept with their causes. The drill document gains the OpenBao platform-admin login that stage 1 silently requires. The LLDAP declaration moves ld-admin and the svc-* binds to active and admin to human-only; SI-X1 is closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
95 lines
4.5 KiB
YAML
95 lines
4.5 KiB
YAML
schema_version: "0.1"
|
|
service: lldap
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [docs/service-identity-inventory.md, sso-mfa/k8s/authelia/configmap.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, sso-mfa/k8s/privacyidea/realm_bootstrap.py, sso-mfa/k8s/identity-provisioner/deployment.yaml, sso-mfa/k8s/lldap/OPERATOR-GROUPS.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: admin
|
|
principal_type: HUMAN
|
|
purpose: "The human platform administrator; directory rights through lldap_admin on its own password and OTP; no service binds as admin (bind split 2026-10-30)"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin membership"}
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [personal-safe]
|
|
consumers:
|
|
- {name: founder, kind: person}
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation:
|
|
path: "Human password change; no service Secret holds it"
|
|
coupling: []
|
|
status: active
|
|
recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
|
|
- name: ld-admin
|
|
principal_type: HUMAN
|
|
conventions: [service-admin]
|
|
purpose: "LLDAP only: the directory's configured super-admin (LLDAP_LDAP_USER_DN), a sealed fallback; introduced 2026-10-30"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: lldap, activation: BREAK_GLASS, environments: [PRODUCTION]}
|
|
interactive_login: true
|
|
second_factor: unknown
|
|
custody: [delivered-secret, offline-key]
|
|
consumers: []
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "LLDAP_LDAP_USER_PASS in lldap-secrets and the LLDAP custody file (apply-service-secrets.py named rotation)", coupling: [lldap]}
|
|
status: active
|
|
- name: svc-authelia
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "Authelia's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: authelia, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with Authelia only", coupling: [authelia]}
|
|
status: active
|
|
- name: svc-keycape
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "KeyCape's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: keycape, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with KeyCape only", coupling: [keycape]}
|
|
status: active
|
|
- name: svc-privacyidea
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
purpose: "The privacyIDEA resolver's read-only directory lookup"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: privacyidea, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Resolver bind password, stored encrypted in the privacyIDEA database", coupling: [privacyidea]}
|
|
status: active
|
|
- name: svc-provisioner
|
|
principal_type: SERVICE
|
|
purpose: "identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)"
|
|
grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: identity-provisioner, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Secret rotation with the provisioner only", coupling: [identity-provisioner]}
|
|
status: active
|
|
exceptions:
|
|
- id: SI-X6
|
|
rules: [SI-3]
|
|
identity: svc-provisioner
|
|
reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members"
|
|
owner: "Founder"
|
|
expires: 2027-04-30
|
|
compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist"
|
|
elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users"
|