tegwick
ab25dde80d
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
64 lines
3.4 KiB
Markdown
64 lines
3.4 KiB
Markdown
# Operator groups — membership runbook
|
|
|
|
Exercise status: unknown for the procedures in this runbook; no per-procedure successful-run receipt with operator attribution was established in the 2026-09-05 review. See [procedure inventory](../../../docs/attended-procedure-inventory.md).
|
|
|
|
Least-privilege **app-scoped** LLDAP groups that gate browser SSO via Authelia
|
|
domain rules. Distinct from platform groups (`net-kingdom-users` /
|
|
`net-kingdom-admins`).
|
|
|
|
## Groups
|
|
|
|
| Group | Gates (Authelia) | Who belongs |
|
|
|-------|------------------|-------------|
|
|
| `activity-core-operators` | `activity.coulomb.social`, `temporal.coulomb.social` | Named founders / platform operators who need the activity-core ops console or Temporal UI |
|
|
|
|
**Do not** auto-add everyone in `net-kingdom-admins`. Membership is a conscious
|
|
grant. Platform admin ≠ activity-core operator.
|
|
|
|
Group bootstrap uses [explicit custody and reviewed preview/apply](GROUP-MAINTENANCE.md).
|
|
Only missing empty baseline groups are created; native estate acceptance remains
|
|
NK-WP-0049-T03. Authelia config:
|
|
`sso-mfa/k8s/authelia/configmap.yaml` (`access_control.rules`).
|
|
|
|
## WebUI path
|
|
|
|
1. Open https://lldap.coulomb.social (IP-restricted admin UI).
|
|
2. Sign in as `admin` (password from KeePassXC / custody — never commit it).
|
|
3. **Groups** → `activity-core-operators` → add or remove members.
|
|
4. User must already exist through governed User Engine / identity-provisioner onboarding; see [current owner routes](../../../docs/legacy-lldap-lifecycle-retirement.md).
|
|
5. User re-authenticates at Authelia if an old session lacks the group claim
|
|
(sign out / new browser session).
|
|
|
|
## Scripted path
|
|
|
|
Use [group maintenance](GROUP-MAINTENANCE.md) with explicit private custody.
|
|
For an existing identity and app-scoped group, `manage-group-members.sh add` or
|
|
`remove` previews an exact change; apply requires its reviewed snapshot digest.
|
|
`list` is read-only. Tenant/platform/LLDAP administrative groups are refused.
|
|
No Kubernetes Secret extraction or shell-export step is required. Existing live
|
|
authority and protected execution remain required; the source adapter grants none.
|
|
|
|
## Onboarding checklist (activity-core ops)
|
|
|
|
1. User has LLDAP account and is in `net-kingdom-users` (normal onboarding).
|
|
2. Operator adds them to `activity-core-operators` (attended WebUI or reviewed group adapter under existing authority).
|
|
3. User signs in at https://auth.coulomb.social (password; MFA via KeyCape path
|
|
when using OIDC apps — ForwardAuth to ops hosts uses Authelia session).
|
|
4. Open https://activity.coulomb.social and https://temporal.coulomb.social —
|
|
both should pass only for group members.
|
|
5. Offboard: remove from `activity-core-operators` first; full account offboard
|
|
remains the platform lifecycle path.
|
|
|
|
## Break-glass (independent of this group)
|
|
|
|
activity-core ClusterIP port-forward + `ACTIVITY_CORE_OPERATOR_TOKEN` does **not**
|
|
use Authelia groups. Documented in activity-core runbooks. Keep that path for
|
|
SSO outages; do not gate break-glass on LLDAP group membership.
|
|
|
|
## Adding a future app-operator group
|
|
|
|
1. Have the service/IAM owner establish its app-scoped group through the existing provider or attended UI. The fixed baseline bootstrap is not a registry for new apps.
|
|
2. Document it in this table.
|
|
3. Add Authelia domain rules (member `one_factor` + domain `deny` fallback) in
|
|
`sso-mfa/k8s/authelia/configmap.yaml` — see Authelia README.
|
|
4. Never invent a KeyCape OIDC client solely for Traefik ForwardAuth apps.
|