817c122d07
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
87 lines
4.2 KiB
Markdown
87 lines
4.2 KiB
Markdown
---
|
|
id: RPF-WP-0040
|
|
type: workplan
|
|
title: "Establish KeyCape factor credential custody and renewal"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: financials
|
|
created: "2026-09-13"
|
|
updated: "2026-09-13"
|
|
state_hub_workstream_id: "fa606195-422d-5121-be63-38192380b1eb"
|
|
---
|
|
|
|
User authorized establishing custody/delivery on 2026-09-13 and offered attended administrative authentication. Supports USER-WP-0030-T03 and KEY-WP-0035-T02. Existing incident lanes are not silently repurposed.
|
|
|
|
## Establish exact-path custody and workload delivery metadata
|
|
|
|
```task
|
|
id: RPF-WP-0040-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3faba86f-795b-5140-a1ed-87ce0c3c1616"
|
|
```
|
|
|
|
New KV v2 path platform/workloads/net-kingdom/keycape-factor-read, field TOKEN, provider expiry metadata. Reader role binds only sso/keycape-factor-eso, audience openbao, exact-path read policy and fifteen-minute OpenBao tokens. Attended admin metadata apply, exact readback and capability checks. No wildcard secret access or secret value in output.
|
|
|
|
## Provision a bounded provider identity and renewable credential
|
|
|
|
```task
|
|
id: RPF-WP-0040-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "04cf9de8-0306-595f-af3a-bfa9046a25ea"
|
|
```
|
|
|
|
Create dedicated privacyIDEA keycape-factor-reader with coulomb tokenlist permission. Preserve existing admin rights; baseline has no admin policies. Store renewable issuer credential separately from the delivered JWT. Use protected stdin and in-memory handling, provider-issued JWT with expiry, positive cross-user scope and negative admin policy-read checks. No personal admin password in runtime.
|
|
|
|
## Activate and verify renewal and consumer delivery
|
|
|
|
```task
|
|
id: RPF-WP-0040-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "b60dc6dc-628b-5ffa-9e5c-e897365cd90f"
|
|
```
|
|
|
|
Deliver via namespace-scoped ESO, activate KeyCape adminTokenFile with byte-preserving config CAS, schedule renewal before expiry and verify mounted reload and native scope. Predecessor expiry/revocation and recovery drills remain T04. Verify effective scope and real factor acceptance before optional client policy. Preserve existing incident residuals in NK-WP-0033.
|
|
|
|
Live implementation and evidence: docs/evidence/2026-09-13-keycape-factor-custody.md.
|
|
Fourteen offline tests pass; native renewal, exact-path ESO delivery, negative
|
|
scope checks, provider per-user lookup and mounted rotation passed. KeyCape
|
|
rolled out Ready 1/1 without changing MFA policy or signing/client secrets.
|
|
|
|
## Verify provider expiry and revocation recovery
|
|
|
|
```task
|
|
id: RPF-WP-0040-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c7803984-e96d-5503-9214-6dc2a1a84fbe"
|
|
```
|
|
|
|
Exercise genuine JWT expiry, provider-side permission withdrawal and recovery
|
|
with an isolated fixture, preserving real users' factors and admin access.
|
|
Verify rejected predecessor handling independently of OpenBao token revocation.
|
|
Include provider interruption/retry evidence and maintain visible failed-Job /
|
|
ExternalSecret failure signals. This is remaining acceptance, not another owner
|
|
handoff. Historical resolver incident NK-WP-0033 remains separately open.
|
|
|
|
|
|
2026-09-13 T04 completed: KeyCape installed-provider isolated Job
|
|
`provider-p05-contract-01` passed genuine provider JWT expiry, fresh-session
|
|
recovery, continued expired-predecessor denial and actual permission withdrawal /
|
|
recovery. Existing Go tests cover provider interruption, missing credential and
|
|
mounted replacement recovery with no stale fallback. Native proof
|
|
`keycape-factor-proof-91ea82cd` passed all eight scope/rotation/revocation checks;
|
|
renewal `keycape-factor-rotate-91ea82cd` succeeded. CronJob retains three failed
|
|
Jobs; ExternalSecret reports Ready/SecretSynced. Full receipts and test boundaries
|
|
are recorded in user-engine/docs/evidence/2026-09-13-p05-service-operations.md.
|
|
|
|
Residual ownership: historical resolver incident remains the existing live
|
|
NK-WP-0033; client policy/optional onboarding is live KEY-WP-0035 and
|
|
USER-WP-0030-T03/P06. No residual is parked only in this completion note. Renewal
|
|
is not predecessor revocation: the fixture independently proves expired JWTs
|
|
stay denied after a new session is issued. Production credentials/factors were
|
|
not deliberately revoked to simulate outage.
|