817c122d07
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
69 lines
4.2 KiB
Markdown
69 lines
4.2 KiB
Markdown
# KeyCape factor credential custody — 2026-09-13
|
|
|
|
User-authorized attended setup is live under RPF-WP-0040 / CCR-2026-0023.
|
|
The operator authenticated through the contained OpenBao login lane. No
|
|
credential value was included in source, receipts, chat or ordinary logs.
|
|
|
|
Dedicated privacyIDEA identity `keycape-factor-reader` has `tokenlist` permission
|
|
for `coulomb`. Its password is in a separate OpenBao issuer path; KeyCape
|
|
receives only a provider-issued, expiring JWT via External Secrets. Explicit
|
|
fallback policy preserves existing administrators' prior rights and excludes
|
|
this service identity. The service cannot read provider administration policy.
|
|
|
|
Live checks passed:
|
|
|
|
- Exact OpenBao policy/role readback, audience and service-account bindings.
|
|
- Provider-issued credential, cross-user factor visibility, and the actual
|
|
KeyCape `user` + `realm` + `active=True` lookup shape.
|
|
- Wrong service account rejected; issuer password and sibling KV reads denied.
|
|
- ExternalSecret `sso/keycape-factor-read`: Ready=True / SecretSynced.
|
|
- Initial renewal Job published KV version 2 and revoked its OpenBao session.
|
|
A second Job published version 3; the existing mounted file received the
|
|
replacement and provider lookup accepted it without a pod restart.
|
|
- KeyCape config activation passed server dry-run and UID/resource-version CAS;
|
|
readback confirmed all other Secret data and configuration bytes preserved.
|
|
Deployment rolled out successfully with the existing image
|
|
`sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6`.
|
|
- Fourteen offline tests cover identity/expiry/status rejection, scope boundaries,
|
|
failed-provider preservation, CAS failure, session-cleanup failure, retry,
|
|
ambiguous config rejection and byte-preserving activation.
|
|
|
|
Runtime source: `manifests/keycape-factor-custody.yaml`; renewal every ten minutes,
|
|
ESO refresh every minute. Renewal runs as non-root with an immutable ConfigMap,
|
|
digest-pinned image, dedicated service account and restricted network policy.
|
|
The reader has no issuer-password permission; the renewer cannot write that
|
|
password. OpenBao sessions last at most fifteen minutes (ESO) or five minutes
|
|
(renewer). Successful renewal workers revoke their sessions explicitly.
|
|
|
|
Repeat: `make keycape-factor-tests` and `make keycape-factor-live-acceptance`.
|
|
Exact-commit CI is `.forgejo/workflows/keycape-factor-acceptance.yaml`.
|
|
The first proof Job was `keycape-factor-delivery-acceptance`; its short-lived
|
|
reader session expires by its fifteen-minute maximum TTL. The final reusable
|
|
proof also revokes its session; its result is recorded below after execution.
|
|
|
|
Limits: this establishes credential custody, renewal and native delivery.
|
|
Genuine provider JWT expiry/revocation drills remain RPF-WP-0040-T04; renewing a
|
|
JWT does not revoke its predecessor. Optional-after-enrollment policy remains
|
|
unchanged. OTP onboarding, lost-factor recovery and their complete platform-admin
|
|
browser journeys remain KEY-WP-0035 / USER-WP-0030. Historical resolver incident
|
|
NK-WP-0033 is not closed by this new service lane.
|
|
|
|
Final reusable proof passed: `keycape-factor-proof-0c4a6929`. All eight checks
|
|
were true: wrong-SA rejection, issuer-password denial, sibling-secret denial,
|
|
mounted-token/custody equality, KeyCape per-user lookup, provider administration
|
|
denial, renewed projection acceptance, and explicit reader-session revocation.
|
|
KeyCape remained Ready 1/1 at deployment generation 46. CCR validation passed.
|
|
|
|
|
|
## P05 acceptance closure — 2026-09-13
|
|
|
|
RPF-WP-0040-T04 is complete. Actual installed-provider isolated fixture
|
|
`provider-p05-contract-01` verifies expiry, fresh-session recovery, expired
|
|
predecessor denial and policy permission withdrawal/recovery. Native proof
|
|
`keycape-factor-proof-91ea82cd` repeated all eight checks successfully, including
|
|
mounted rotation after renewal Job `keycape-factor-rotate-91ea82cd` and explicit
|
|
proof-session revocation. CronJob retains failed Jobs (limit 3), and ESO reports
|
|
Ready/SecretSynced. Provider and credential failure/recovery are covered by
|
|
KeyCape's Go adapter suite. See user-engine's P05 evidence for exact boundaries.
|
|
The preceding "remaining T04" statements are historical and superseded here.
|
|
Existing NK-WP-0033 and KEY-WP-0035 retain resolver/policy residual ownership.
|