tegwick
c07e6ebe34
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
81 lines
3.7 KiB
JSON
81 lines
3.7 KiB
JSON
{
|
|
"schema": "netkingdom.reset-role-proposal.v1",
|
|
"proposal_id": "NK-WP-0054-reset-authority-20261031-1",
|
|
"authority_status": "proposed_not_granted",
|
|
"endpoint": "https://lldap.coulomb.social",
|
|
"target": "svc-authelia",
|
|
"subject": "tegwick",
|
|
"before_roles": [
|
|
"lldap_strict_readonly"
|
|
],
|
|
"after_roles": [
|
|
"lldap_password_manager"
|
|
],
|
|
"runtime": {
|
|
"schema": "netkingdom.reset-runtime.v1",
|
|
"kube-system_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
|
"sso_uid": "a4a148d8-92ab-41e6-b975-4e67b73edfc0",
|
|
"authelia": {
|
|
"uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
|
|
"images": [
|
|
"docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54"
|
|
],
|
|
"ready": true
|
|
},
|
|
"lldap": {
|
|
"uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
|
|
"images": [
|
|
"docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
|
|
],
|
|
"ready": true
|
|
},
|
|
"authelia_configuration": {
|
|
"uid": "7af1fa0d-1bd4-47e1-8873-0f620788ef3f",
|
|
"sha256": "0a8bca50641a4c6f27830f476c2c9f413fc3795711becccb8344ee4d6c376e80",
|
|
"bind_is_svc_authelia": true
|
|
}
|
|
},
|
|
"scope": {
|
|
"change": "Replace only svc-authelia strict-readonly membership with password-manager membership.",
|
|
"password_reach": "Every non-LLDAP-admin directory identity, including non-admin service and application-admin accounts; not limited to Coulomb.",
|
|
"excluded": "LLDAP administrators; tested user/group creation, other-profile edits and membership changes remain refused.",
|
|
"unchanged": "Credentials, service username, Kubernetes resources, Authelia account filter, MFA policy and all other directory memberships.",
|
|
"rollback": "Restore only svc-authelia strict-readonly role; retain any user password changes and unrelated directory updates. Existing HTTP tokens are not revoked: a token issued with password-manager rights can retain them until expiry (up to 24 hours), or an owner-run token revocation.",
|
|
"interruption": "Removing the old role precedes adding the new one. Brief lookup failure is possible. Uncertain attempts require explicit attended recovery; never blindly repeat grant.",
|
|
"acceptance": "Role postflight is not a user reset, app login, MFA or fresh-backup restore verdict.",
|
|
"self_profile": "Both built-in roles permit own-profile/password operations; this proposal does not claim an exhaustive denial of every directory write.",
|
|
"recovery_runtime": "Recovery tolerates unready workloads but still requires the reviewed namespace/deployment identities, images and configuration.",
|
|
"follow_through": "After a verified grant, align the service declaration and bind verification expectations; obtain the personal reset/app/MFA verdict and fresh identity backup/restore proof under NK-WP-0054-T16."
|
|
},
|
|
"proposed_service_identity": {
|
|
"principal_type": "SERVICE",
|
|
"conventions": [],
|
|
"purpose": "Authelia directory lookup and user-requested password recovery",
|
|
"grants": [
|
|
{
|
|
"mode": "USE",
|
|
"scope": "directory",
|
|
"read_only": true,
|
|
"activation": "STANDING",
|
|
"environments": [
|
|
"PRODUCTION"
|
|
]
|
|
},
|
|
{
|
|
"mode": "ADMINISTER",
|
|
"scope": "directory/passwords/non-lldap-admin",
|
|
"activation": "STANDING",
|
|
"environments": [
|
|
"PRODUCTION"
|
|
],
|
|
"note": "Native lldap_password_manager; includes non-admin service identities and application administrators."
|
|
}
|
|
],
|
|
"consumer": "authelia",
|
|
"owner_confirmed": false
|
|
},
|
|
"live_declaration_updated": false,
|
|
"new_resources": 0,
|
|
"credentials_rotated": false,
|
|
"requires_founder_admission": true
|
|
}
|