coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0055: state the gate precisely (attended pi-admin, MFA login proves the write)
All checks were successful
CCR intake gate / gate (push) Successful in 9s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
codex 2026-10-31 11:07:05 +01:00
parent 2d4a3838bf
commit 8cab281ffc
3 changed files with 17 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/credential-lane-designs/attended-service-credential-delivery.md
View file

@ -4,18 +4,19 @@ Request type `attended-service-credential-delivery` (`scripts/attended_service_d
CCR-2026-0055 (NetKingdom `svc-privacyidea`, NK-WP-0056-T04).
Some services keep a credential in their own encrypted store and accept it only through an administrator API
that requires a person's MFA. privacyIDEA's LDAP resolver is one: its `BINDPW` lives encrypted in the
privacyIDEA database and only `pi-admin` with a fresh code may change it. ESO cannot deliver such a value, and an
unattended job would need an administrator credential without MFA.
that a person operates. privacyIDEA's LDAP resolver is one: its `BINDPW` lives encrypted in the privacyIDEA
database and only the `pi-admin` API may change it. ESO cannot deliver such a value, and an unattended job would
need the administrator password standing in the cluster.
The contract therefore holds the value in OpenBao and nothing else:
- `openbao.auth` is the attended `platform-admin` OIDC session on `netkingdom`; `runtime_access: false`;
`initial_cas: 0`. No policy, auth role, ESO object or other access may be declared.
- The runtime frontdoor stays disabled (`access_frontdoor.resolvable: false`).
- `delivery` names the service, the target inside it, the owner's procedure and the gate (the person's MFA).
- `delivery` names the service, the target inside it, the owner's procedure and the gate (the attended person and
the proof they run).
- Approval follows `review.required_approvers`; from `applied` onward every listed role must have approved.
The owner's procedure reads the value in memory under the attended session and writes it into the service; the
person's MFA remains the gate. A rotation needs no decrypted custody copy. Modelled on
person runs it and proves the write with an MFA login through the service. A rotation needs no decrypted custody copy. Modelled on
`attended-host-key-delivery` (CCR-2026-0028), which delivers to a host file instead of a service.