diff --git a/docs/directory-group-binding.md b/docs/directory-group-binding.md new file mode 100644 index 0000000..3556044 --- /dev/null +++ b/docs/directory-group-binding.md @@ -0,0 +1,47 @@ +# Directory group binding for a construction plan + +A construction plan that needs an LLDAP group does not create it in ops-mason, +and user-engine does not create it either. user-engine owns account journeys +and factor enrollment. The group writer is net-kingdom's identity-provisioner. + +## The automatic path + +`POST /v1/groups/ensure` on identity-provisioner +(`net-kingdom/identity-provisioner/provisioner.py`, `ensure_service_groups`). +The matching rollback is `POST /v1/groups/revoke`. Both require the +provisioner's own bearer token and are reached inside the provisioner pod. +ops-warden does not publish a caller route for this: `identity-provisioner-groups` +was dropped (WARDEN-WP-0044, R8) because that token is user-engine's runtime +token and the pod network only admits user-engine. + +The request names `groups`, `members`, `idempotency_key` and `correlation_id`. +The call creates a missing service-access group and adds the listed users. It +does not remove other members, and it does not create users. A group name +matches `[a-z][a-z0-9-]{1,62}` and must not start with `tenant`, +`netkingdom-`, `net-kingdom-` or `lldap_`. A username must already exist and +match `[a-z][a-z0-9._-]{0,31}`. `reuse-surface-hub-writers` and +`bernd.worsch-3` fit those shapes. + +The SecurityCaseType `oidc-browser-relying-party` calls this `ensure-groups`, +attended, in the register-client session. There is no `identity-provisioner +groups ensure` command in the provisioner tree; the workplan text names that +shape, and the code is the HTTP path above. + +## What this path does not do + +- It does not enroll a second factor. `aal2` is a KeyCape claim on one login + (`/assurance/level`), set only when that login verified MFA. Enrollment is + privacyIDEA self-service at `https://pink-account.coulomb.social/`, realm + `coulomb` (user-engine `docs/mfa-attended-run.md`). +- It does not choose the OpenBao entity. Entity policies such as + `platform-admin` still have to be checked on the login token. +- `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` is the narrower + bootstrap helper. It creates only `net-kingdom-users`, `net-kingdom-admins` + and `activity-core-operators`, and its membership command requires the group + to exist already. + +## Reuse-surface + +ops-mason records the pointer on `capability.security.structure-construction`. +The implementation owner is net-kingdom. A later owner entry can name +`POST /v1/groups/ensure` directly; until then this page is the consumer route. diff --git a/docs/reuse-surface-hub-writer-attended.md b/docs/reuse-surface-hub-writer-attended.md index a9a9a5e..e2a8e0e 100644 --- a/docs/reuse-surface-hub-writer-attended.md +++ b/docs/reuse-surface-hub-writer-attended.md @@ -6,11 +6,13 @@ Plan: `plans/reuse-surface-hub-writer.md`. Filed request: `builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`. Run this only after CCR-2026-0044 is approved and applied, and after the -founder has created LLDAP group `reuse-surface-hub-writers` in the admin UI -at `lldap.coulomb.social`. key-cape does not create that group from the repo, -and `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` does not create it -either. The member must not be OpenBao entity -`4a1f663c-0621-0483-edd0-f852274f4b6b`. +founder has created LLDAP group `reuse-surface-hub-writers` with member +`bernd.worsch-3`. That user still has to enroll a second factor at +`https://pink-account.coulomb.social/` before `member` can pass: the role +requires `/assurance/level=aal2`. The member must not be OpenBao entity +`4a1f663c-0621-0483-edd0-f852274f4b6b`. Later groups of this shape go through +identity-provisioner `POST /v1/groups/ensure`; see +`docs/directory-group-binding.md`. The script leaves `~/.vault-token` in place and uses it only to call `sys/capabilities`. The lane token is not printed and is revoked before the diff --git a/plans/reuse-surface-hub-writer.md b/plans/reuse-surface-hub-writer.md index d498031..9b19ff2 100644 --- a/plans/reuse-surface-hub-writer.md +++ b/plans/reuse-surface-hub-writer.md @@ -168,7 +168,7 @@ Not applied. No live receipt yet. 2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044 (`88b4aed`, message `14e23602`). The live policy file stays as it was until -apply. key-cape (message `b0ec5f8e`) has no group `reuse-surface-hub-writers` -and will not create it from the repo. The founder creates that group in the -LLDAP admin UI, then names the member entity id. `bound_claims_confirmed` -stays false. +apply. The founder created LLDAP group `reuse-surface-hub-writers` with +member `bernd.worsch-3`. That user has no second factor, so the `aal2` bound +claim cannot succeed yet. `tegwick` is not the member. The OpenBao entity id +is still unrecorded. `bound_claims_confirmed` stays false. diff --git a/registry/capabilities/capability.security.structure-construction.md b/registry/capabilities/capability.security.structure-construction.md index 0983498..3c52121 100644 --- a/registry/capabilities/capability.security.structure-construction.md +++ b/registry/capabilities/capability.security.structure-construction.md @@ -40,6 +40,9 @@ discovery: - Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply excludes: - Founder plan gate is an explicit exception; not full PDP conformance + - Creating LLDAP groups or enrolling MFA. Service-access groups are + identity-provisioner POST /v1/groups/ensure. Second-factor enrollment is + user-engine / privacyIDEA. use_cases: - 'U01: Architect composes a security deployment from explicit owner contracts and case types' @@ -53,6 +56,7 @@ availability: current_artifacts: - SCOPE.md - docs/construction-plan-format.md + - docs/directory-group-binding.md consumption_modes: - CLI - source @@ -61,10 +65,12 @@ relations: - capability.security.credential-lifecycle - capability.security.iam-tooling-suite - capability.railiance.platform-services + - capability.identity.user-engine evidence: documentation: - SCOPE.md - docs/construction-plan-format.md + - docs/directory-group-binding.md consumer_guidance: recommended_for: - Architect composes a security deployment from explicit owner contracts and case @@ -77,6 +83,7 @@ consumer_guidance: - Founder plan gate is an explicit exception; not full PDP conformance known_limitations: - Founder plan gate is an explicit exception; not full PDP conformance + - Directory groups are not created here. See docs/directory-group-binding.md. - 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment. --- @@ -99,5 +106,16 @@ Founder plan gate is an explicit exception; not full PDP conformance. - [SCOPE.md](../../SCOPE.md) - [docs/construction-plan-format.md](../../docs/construction-plan-format.md) +- [docs/directory-group-binding.md](../../docs/directory-group-binding.md) + +## Service-access groups + +ops-mason names the group in the plan. net-kingdom identity-provisioner creates +it with `POST /v1/groups/ensure` inside the provisioner pod. user-engine does +not write LLDAP groups; it is the account and MFA journey, including TOTP +enrollment at `https://pink-account.coulomb.social/`. The call does not enroll +a factor and does not attach OpenBao policies. Reserved prefixes +`tenant`, `netkingdom-`, `net-kingdom-` and `lldap_` are refused. Details: +[docs/directory-group-binding.md](../../docs/directory-group-binding.md). Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md index 81bc99b..59a2260 100644 --- a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md +++ b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md @@ -64,31 +64,28 @@ id: MASON-WP-0011-T02 status: wait depends_on: [MASON-WP-0011-T01] blocked_on: human -blocking_reason: "Founder creates LLDAP group reuse-surface-hub-writers in the admin UI and names a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b with no platform-admin or operator-custody identity policy. key-cape b0ec5f8e: no directory record, and this path is not created from the repo." +blocking_reason: "Group reuse-surface-hub-writers exists; member is bernd.worsch-3. That user has no second factor, so the role's aal2 login cannot pass yet. OpenBao entity id is still unrecorded and must not be 4a1f663c-0621-0483-edd0-f852274f4b6b." priority: high state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700" ``` -key-cape (message `b0ec5f8e`, 2026-10-14) has no directory record for -`reuse-surface-hub-writers` and did not create one. Live membership is an -attended directory change. The maintenance helper in -`net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` only creates -`net-kingdom-users`, `net-kingdom-admins` and `activity-core-operators`, and -its membership command refuses to create a group. The precedent is -`fluid-telegram-operators`: the founder creates the group in the LLDAP admin -UI at `lldap.coulomb.social`. +key-cape (message `b0ec5f8e`, 2026-10-14) had no directory record and did +not create one from the repo. The founder then created LLDAP group +`reuse-surface-hub-writers` and added `bernd.worsch-3`. `tegwick` is not the +member. `bernd.worsch-3` has no second factor yet, so a login cannot carry +`/assurance/level=aal2`. Enrollment is privacyIDEA self-service at +`https://pink-account.coulomb.social/`, realm `coulomb`. The OpenBao entity +id is still unrecorded. It must not be +`4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin` +or `operator-custody`. -Founder steps, with no secret in the reply: +The automatic group path is identity-provisioner `POST /v1/groups/ensure`, +not user-engine and not ops-mason. See `docs/directory-group-binding.md`. +The LLDAP maintenance helper does not create this group name. -1. Create group `reuse-surface-hub-writers`. -2. Add one member who can pass aal2. `tegwick` is the precedent for a - non-admin attended operator. The member's OpenBao entity must not be - `4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin` - or `operator-custody`. -3. Reply with the group name and the member entity id only. - -`bound_claims_confirmed` stays false until that reply. CCR-2026-0044 stays -proposed until platform-operator and reuse-surface-owner approve. +`bound_claims_confirmed` stays false until the member entity is checked. +CCR-2026-0044 stays proposed until platform-operator and reuse-surface-owner +approve. ## Apply the role without a KV write