46 lines
2.1 KiB
Markdown
46 lines
2.1 KiB
Markdown
|
# NetKingdom credential custody contract
|
||
|
|
|
||
|
|
Status: **draft / blocked pending OpenBao owner confirmation**
|
||
|
|
Incident: `KEYCAPE-EXPOSURE-20260823-01`
|
||
|
|
Consumer procedure: NetKingdom `NK-WP-0033`, resolver reconciliation revision
|
||
|
|
`eec7007` / checkout `f2e578c`
|
||
|
|
|
||
|
|
This document defines the Railiance-side contract without containing or
|
||
|
|
deriving any credential value. It is not an authorization to fetch, export,
|
||
|
|
apply, or rotate a secret.
|
||
|
|
|
||
|
|
## Ownership
|
||
|
|
|
||
|
|
- `railiance-platform` owns OpenBao custody, policy, delivery, rotation
|
||
|
|
metadata, and revocation evidence.
|
||
|
|
- `net-kingdom` owns the privacyIDEA resolver contract and attended consumer
|
||
|
|
reconciliation.
|
||
|
|
- `ops-warden` routes the lane only; it does not fetch or proxy either value.
|
||
|
|
|
||
|
|
## Required OpenBao metadata (owner must fill, never guess)
|
||
|
|
|
||
|
|
| Lane | Canonical path | Field | Delivery | Status |
|
||
|
|
| --- | --- | --- | --- | --- |
|
||
|
|
| `net-kingdom-lldap-bind-credential` | `REQUIRED_FROM_OPENBAO_OWNER` | `REQUIRED_FROM_OPENBAO_OWNER` | protected attended input to NetKingdom resolver helper | blocked |
|
||
|
|
| `net-kingdom-privacyidea-admin-token` | `REQUIRED_FROM_OPENBAO_OWNER` | `REQUIRED_FROM_OPENBAO_OWNER` | protected attended input to provider-admin helper | blocked |
|
||
|
|
|
||
|
|
The owner receipt must also identify the KV mount/version semantics, the
|
||
|
|
least-privilege read/update policy, the authentication method, the expiry or
|
||
|
|
rotation behavior, and the approved attended handoff. No value belongs in this
|
||
|
|
file, State Hub, Git, chat, argv, or ordinary logs.
|
||
|
|
|
||
|
|
## Consumer handoff
|
||
|
|
|
||
|
|
Once the OpenBao owner supplies the metadata above, Railiance-platform records
|
||
|
|
the receipt identifier and passes only protected input to the pinned
|
||
|
|
NetKingdom procedure. The resolver repair must use the minimal two-input
|
||
|
|
`--reconcile` flow; audit proofs (lookup, MFA, predecessor denial) remain a
|
||
|
|
separate read-only operation.
|
||
|
|
|
||
|
|
## Current gate
|
||
|
|
|
||
|
|
The routing lane is registered but remains `resolvable: false`. No
|
||
|
|
`warden access --fetch`, proxy execution, resolver retry, or predecessor
|
||
|
|
restoration is authorized until the OpenBao owner publishes the missing
|
||
|
|
metadata and the attended handoff is approved.
|