tegwick
100558696f
The hub-writer group exists and its member has no second factor yet. Service-access groups are created by identity-provisioner POST /v1/groups/ensure; that pointer is now on the ops-mason reuse-surface capability. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
47 lines
2.4 KiB
Markdown
47 lines
2.4 KiB
Markdown
# Directory group binding for a construction plan
|
|
|
|
A construction plan that needs an LLDAP group does not create it in ops-mason,
|
|
and user-engine does not create it either. user-engine owns account journeys
|
|
and factor enrollment. The group writer is net-kingdom's identity-provisioner.
|
|
|
|
## The automatic path
|
|
|
|
`POST /v1/groups/ensure` on identity-provisioner
|
|
(`net-kingdom/identity-provisioner/provisioner.py`, `ensure_service_groups`).
|
|
The matching rollback is `POST /v1/groups/revoke`. Both require the
|
|
provisioner's own bearer token and are reached inside the provisioner pod.
|
|
ops-warden does not publish a caller route for this: `identity-provisioner-groups`
|
|
was dropped (WARDEN-WP-0044, R8) because that token is user-engine's runtime
|
|
token and the pod network only admits user-engine.
|
|
|
|
The request names `groups`, `members`, `idempotency_key` and `correlation_id`.
|
|
The call creates a missing service-access group and adds the listed users. It
|
|
does not remove other members, and it does not create users. A group name
|
|
matches `[a-z][a-z0-9-]{1,62}` and must not start with `tenant`,
|
|
`netkingdom-`, `net-kingdom-` or `lldap_`. A username must already exist and
|
|
match `[a-z][a-z0-9._-]{0,31}`. `reuse-surface-hub-writers` and
|
|
`bernd.worsch-3` fit those shapes.
|
|
|
|
The SecurityCaseType `oidc-browser-relying-party` calls this `ensure-groups`,
|
|
attended, in the register-client session. There is no `identity-provisioner
|
|
groups ensure` command in the provisioner tree; the workplan text names that
|
|
shape, and the code is the HTTP path above.
|
|
|
|
## What this path does not do
|
|
|
|
- It does not enroll a second factor. `aal2` is a KeyCape claim on one login
|
|
(`/assurance/level`), set only when that login verified MFA. Enrollment is
|
|
privacyIDEA self-service at `https://pink-account.coulomb.social/`, realm
|
|
`coulomb` (user-engine `docs/mfa-attended-run.md`).
|
|
- It does not choose the OpenBao entity. Entity policies such as
|
|
`platform-admin` still have to be checked on the login token.
|
|
- `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` is the narrower
|
|
bootstrap helper. It creates only `net-kingdom-users`, `net-kingdom-admins`
|
|
and `activity-core-operators`, and its membership command requires the group
|
|
to exist already.
|
|
|
|
## Reuse-surface
|
|
|
|
ops-mason records the pointer on `capability.security.structure-construction`.
|
|
The implementation owner is net-kingdom. A later owner entry can name
|
|
`POST /v1/groups/ensure` directly; until then this page is the consumer route.
|