coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/docs/directory-group-binding.md
tegwick 100558696f Record bernd.worsch-3 and the group-ensure route. 
The hub-writer group exists and its member has no second factor yet. Service-access groups are created by identity-provisioner POST /v1/groups/ensure; that pointer is now on the ops-mason reuse-surface capability.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
2026-10-14 19:05:33 +02:00

2.4 KiB
Raw Blame History

Directory group binding for a construction plan

A construction plan that needs an LLDAP group does not create it in ops-mason, and user-engine does not create it either. user-engine owns account journeys and factor enrollment. The group writer is net-kingdom's identity-provisioner.

The automatic path

POST /v1/groups/ensure on identity-provisioner (net-kingdom/identity-provisioner/provisioner.py, ensure_service_groups). The matching rollback is POST /v1/groups/revoke. Both require the provisioner's own bearer token and are reached inside the provisioner pod. ops-warden does not publish a caller route for this: identity-provisioner-groups was dropped (WARDEN-WP-0044, R8) because that token is user-engine's runtime token and the pod network only admits user-engine.

The request names groups, members, idempotency_key and correlation_id. The call creates a missing service-access group and adds the listed users. It does not remove other members, and it does not create users. A group name matches [a-z][a-z0-9-]{1,62} and must not start with tenant, netkingdom-, net-kingdom- or lldap_. A username must already exist and match [a-z][a-z0-9._-]{0,31}. reuse-surface-hub-writers and bernd.worsch-3 fit those shapes.

The SecurityCaseType oidc-browser-relying-party calls this ensure-groups, attended, in the register-client session. There is no identity-provisioner groups ensure command in the provisioner tree; the workplan text names that shape, and the code is the HTTP path above.

What this path does not do

  • It does not enroll a second factor. aal2 is a KeyCape claim on one login (/assurance/level), set only when that login verified MFA. Enrollment is privacyIDEA self-service at https://pink-account.coulomb.social/, realm coulomb (user-engine docs/mfa-attended-run.md).
  • It does not choose the OpenBao entity. Entity policies such as platform-admin still have to be checked on the login token.
  • net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md is the narrower bootstrap helper. It creates only net-kingdom-users, net-kingdom-admins and activity-core-operators, and its membership command requires the group to exist already.

Reuse-surface

ops-mason records the pointer on capability.security.structure-construction. The implementation owner is net-kingdom. A later owner entry can name POST /v1/groups/ensure directly; until then this page is the consumer route.