security: record verified realm repair and Playwright recovery return
This commit is contained in:
codex
parent
f18c7579f0
commit
90e2b47152
3 changed files with 243 additions and 4 deletions
|
|
@ -0,0 +1,169 @@
|
|||
{
|
||||
"observed_at": "2026-10-13",
|
||||
"source_repo": "net-kingdom",
|
||||
"source_base": "96feef46ab22811e3736231f04818655ca7b834e",
|
||||
"source_commit": "30f0d2784018daa98e36e7c1042d4e2138a05a7c",
|
||||
"workplan_id": "NK-WP-0049",
|
||||
"task_id": "NK-WP-0049-T02",
|
||||
"custodian_task_id": "CUST-WP-0080-T03",
|
||||
"result": "Source repair and disposable native acceptance passed; live owner acceptance remains open",
|
||||
"changes": [
|
||||
"Replaced shell-sourced/%q credential transfer with literal owned/private files or attended in-memory prompts; no password environment/argv or temporary files.",
|
||||
"Preview by default; explicit apply creates missing resolver/realm or fills only missing tuning; established bind password, custom fields, bindings/priorities and defaults remain unchanged.",
|
||||
"Conflicting backend/type/binding and snapshot drift refuse before writes; each operation is read back; partial/unknown outcomes stop without retry or rollback.",
|
||||
"Removed broad self-service/delete/disable and passthrough policy replay; existing onboarding guard and policy owner procedures remain authoritative.",
|
||||
"Attended wrapper retains known-user lookup and fresh token-backed MFA proof and propagates failure; shared HTTP transport restricts origins, TLS, redirects/proxies and response sizes.",
|
||||
"Updated console action, guides and work records; corrected the historical general claim that resolver POST replaces omitted configuration."
|
||||
],
|
||||
"files": [
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/pi_api.py",
|
||||
"sha256": "2eec0866fb140398c8f096cdbf9f99bed134e39d5cc20551bc66842b17e513a7"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py",
|
||||
"sha256": "2885086fdc4fd64b58496f90e82c75eefc7171017004e0804defaaabf791b3a9"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh",
|
||||
"sha256": "d3dc530d378ce826f4875c4cf066a6f7f916c3abd5492eb5ee237a8c98b7957b"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh",
|
||||
"sha256": "2684a6caca848f5d9e74191af4ca2864adba92fe3ee410a4236045d1743b99e6"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_realm_bootstrap.py",
|
||||
"sha256": "caffb75f7a5fc1091a3d20d08cfd03344a6e78ec53210e69bacd3057fcc5f6e0"
|
||||
},
|
||||
{
|
||||
"path": "tests/realm_bootstrap_native_fixture.py",
|
||||
"sha256": "a943a4c2f4fb78d0bea78242b7900bb1b68066d90ad4b291bad2b98b9b3484da"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_privacyidea_verification.py",
|
||||
"sha256": "3cae495f6f85b23e3f08c8a983020d9f11bd958007eab05852164bb405e10e31"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/README.md",
|
||||
"sha256": "299c68d881dbcda5db03f3435ce0e56034912e29b40a15e58a0dc5044ad21c2d"
|
||||
},
|
||||
{
|
||||
"path": "tools/security-bootstrap-console/security_bootstrap_console.py",
|
||||
"sha256": "ba699abe9194325c55551802c0327948f8e6a8444e97ee83d912a8f1e486766d"
|
||||
},
|
||||
{
|
||||
"path": "tools/security-bootstrap-console/README.md",
|
||||
"sha256": "bc1af3598d667346370a476d0765bff1f0c3ebb57f751c4da6e61a4add29f30d"
|
||||
},
|
||||
{
|
||||
"path": "docs/smooth-bootstrap-guide.md",
|
||||
"sha256": "f58c7075d01a4d497ae58e65520961a5ad24e48bdd87072f2d72aba04681cf19"
|
||||
},
|
||||
{
|
||||
"path": "docs/keycape-exposure-resolver-reconciliation.md",
|
||||
"sha256": "260d5c2117eb711ce1493e8e636c55730c6239e6eded8929a7c1bd2099d4a0b3"
|
||||
},
|
||||
{
|
||||
"path": "docs/verify-t06.md",
|
||||
"sha256": "9c82ebee9c7e3aafc72d282eefd098f2d3f509e8985771d9ac4753296543a751"
|
||||
},
|
||||
{
|
||||
"path": "docs/attended-procedure-inventory.md",
|
||||
"sha256": "f70cce61206aa6f5561089648d808a9c3775d902f1786e7b0b263325f7d573e3"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/WORKPLAN.md",
|
||||
"sha256": "561ec79578f49c23f6bc07ea681d60ef2a83d26fb4f9724632d524c2ea75a467"
|
||||
},
|
||||
{
|
||||
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"sha256": "739df5571a062b06c58b1d338318272f1654770c819505d41da63748eee2b64e"
|
||||
}
|
||||
],
|
||||
"verification": {
|
||||
"full_suite": {
|
||||
"passed": 723,
|
||||
"skipped": 0,
|
||||
"warnings": 4,
|
||||
"exit_code": 0,
|
||||
"elapsed_seconds": 266.15,
|
||||
"command": [
|
||||
"/tmp/nk-pi-key-native/bin/python",
|
||||
"-m",
|
||||
"pytest",
|
||||
"-q",
|
||||
"tests",
|
||||
"tools",
|
||||
"sso-mfa/k8s/keycape",
|
||||
"--tb=short",
|
||||
"-rs"
|
||||
],
|
||||
"source_unchanged_during_run": true,
|
||||
"binding_sha256": "e9d14a69fc3f52b9e09258a4f9b8262650579242093ad07b8c4f4ef2f1d1edd4",
|
||||
"log_sha256": "04f239798a6d71cd486bb8effff9fcfeeed0d6fe2c8a1d8c9de4003a5570ab2f"
|
||||
},
|
||||
"focused_before_final_readback_regression": "54 passed; final broader run covers the added concurrent-default readback refusal as well",
|
||||
"native_package": "privacyIDEA 3.12.2, disposable SQLite and real HTTP API",
|
||||
"native_results": {
|
||||
"native_bind_password_preserved": true,
|
||||
"native_create_and_readback": true,
|
||||
"native_existing_default_preserved": true,
|
||||
"native_hardened_policies_preserved": true,
|
||||
"native_minimal_update_preserves_omitted_fields": true,
|
||||
"native_repeat_is_noop": true
|
||||
},
|
||||
"provider_source_files": [
|
||||
{
|
||||
"path": "api/resolver.py",
|
||||
"sha256": "c8544e5406bb1c581217d414988ea227af528b253f4866f833edafd53db3bea8"
|
||||
},
|
||||
{
|
||||
"path": "lib/resolver.py",
|
||||
"sha256": "3d59fd08ad8ea1678867d8a10129d53b77907c44b604321eeab855ab589edcb5"
|
||||
},
|
||||
{
|
||||
"path": "api/realm.py",
|
||||
"sha256": "c4d03121ddf0c62c15041355c7a3588c07df5ab790a5c3d9aba10b02932264b3"
|
||||
}
|
||||
],
|
||||
"credential_file_regression": {
|
||||
"source_base": "96feef46ab22811e3736231f04818655ca7b834e",
|
||||
"old_executed_credential_file_command": true,
|
||||
"new_executed_credential_file_command": false,
|
||||
"baseline_exit": 1,
|
||||
"fixed_exit": 1,
|
||||
"network_target": "literal loopback port 1; no production endpoint",
|
||||
"test_inputs": "synthetic; marker only in disposable temporary directory"
|
||||
},
|
||||
"attended_pty": "Protected password/fresh OTP prompts complete without rendering inputs, bind prompt omitted for existing resolver, functional result propagated",
|
||||
"committed_files_match_test_binding": true,
|
||||
"shell_syntax": "passed",
|
||||
"initial_test_failures": [
|
||||
{
|
||||
"result": "10 failed, 40 passed",
|
||||
"resolution": "Corrected duplicate keyword in test fixture and replaced obsolete tests that expected unsafe policy replay with preservation assertions."
|
||||
},
|
||||
{
|
||||
"result": "1 failed, 50 passed",
|
||||
"resolution": "Native fixture attempted to create realm-scoped policies before that realm existed; move fixture policy installation after native bootstrap. Native API inspection also corrected default-realm success from boolean to positive integer ID. Subsequent focused/native/full runs passed."
|
||||
}
|
||||
]
|
||||
},
|
||||
"limits": [
|
||||
"No production credential, resolver, realm, policy, factor or workload was read or changed.",
|
||||
"Disposable provider/database checks do not prove deployed-image acceptance, live LDAP reachability, custody or a complete KeyCape sign-in.",
|
||||
"API has no CAS: pre-write snapshots/readback require an exclusive owner window and do not make multiple operations atomic.",
|
||||
"On failure, partial/unknown changes remain for owner reconciliation; there is no blind retry or automatic rollback.",
|
||||
"A configured realm is not an onboarding-policy/hook/enrollment acceptance. Existing approved owner flows retain those duties.",
|
||||
"Explicit loopback HTTP relies on an approved local process/forward. No hostile same-UID memory isolation is claimed.",
|
||||
"Historical incident evidence is not retroactively reclassified by current provider merge semantics.",
|
||||
"LDAP callers, incident-specific cutover/rotation review, complete inventory, historical revocation and T03 native recovery remain open."
|
||||
],
|
||||
"upstream_reference": "https://privacyidea.readthedocs.io/en/stable/modules/api/resolver.html",
|
||||
"knowledge_orientation": {
|
||||
"version": "0.2.6",
|
||||
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld/source changed; current owner sources reviewed directly"
|
||||
}
|
||||
}
|
||||
|
|
@ -9,7 +9,7 @@
|
|||
"obligor_workplan_id": "RPF-WP-0056",
|
||||
"obligor_task_id": "RPF-WP-0056-T03",
|
||||
"state": "waiting",
|
||||
"reason": "Coordinator accepts delivery tracking. Pilot and scoped RBAC delivered; owner registration/custody/transport/authenticator implementation returns and real consumer acceptance remain pending.",
|
||||
"reason": "Pilot and scoped RBAC delivered; same-image abrupt recovery now verified by provider receipts. Remaining delivery: exact owner registration/custody/authenticator/transport revisions, real human/agent trials, provider acceptance and managed discovery; cross-version rollback remains unproven in provider T01.",
|
||||
"request_message_id": "1b279bad-a159-43da-8709-1167882e62f8",
|
||||
"driver_lookup": {
|
||||
"local_project_workplans_scanned": 10,
|
||||
|
|
@ -33,6 +33,36 @@
|
|||
"path": "workplans/RAPP-PLAYWRIGHT-WP-0004-consumer-verification.md",
|
||||
"commit": "3a30ef159ae680da9e03179fcbe4dac9cdcc9cc3",
|
||||
"sha256": "14ddd47537fe25964ed4df02c71a9d78dda74c4e2fb39c427b119de5f18e504e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
"path": "docs/evidence/2026-10-13-crash-recovery.md",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"sha256": "871221e07da35c468f0220aa0852145a83aee6a05a082219281d867d64c5ac4d"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
"path": "docs/evidence/2026-10-13-crash-recovery/managed/verification.json",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"sha256": "87bebb470a0f3839ca6e991b1b3d4932cee04317f0e35bbcc18bd2183316a3fb"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
"path": "docs/evidence/2026-10-13-crash-recovery/local/verification.json",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"sha256": "9ebd8c599cfae45e67c4994a325f78d47cc18fd1ce6ccde1791308e1c3e2ef0a"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
"path": "docs/evidence/2026-10-13-crash-recovery/managed-first-attempt.json",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"sha256": "cb32871a3b9175301444efa1246869550ad3e2c78d26839e52f6df784bd415c3"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
"path": "workplans/RAPP-PLAYWRIGHT-WP-0004-consumer-verification.md",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"sha256": "83410fc8993810fcdcdb4baba191dee334d09aa9c1817943a6dbbdf357ec9a50"
|
||||
}
|
||||
],
|
||||
"linked_existing_tasks": [
|
||||
|
|
@ -55,7 +85,7 @@
|
|||
"task_id": "RAPP-PLAYWRIGHT-WP-0004-T01",
|
||||
"hub_task_id": "09f87694-8832-5ae8-9d0b-b66834ffcfcc",
|
||||
"status_observed": "wait",
|
||||
"responsibility": "Accept native consumer and remaining interruption/recovery evidence."
|
||||
"responsibility": "Accept native human/agent consumer operation and disposition of unproven cross-version rollback; same-image abrupt recovery is delivered."
|
||||
},
|
||||
{
|
||||
"repo": "rapp-playwright",
|
||||
|
|
@ -120,7 +150,7 @@
|
|||
"requires": [
|
||||
"M3"
|
||||
],
|
||||
"deliverable": "Platform and provider accept receipts including remaining abrupt-interruption recovery; publish supported docs and update existing capability.infotech.headless-browser managed availability; read back discovery."
|
||||
"deliverable": "Platform/provider accept real consumer receipts, retain delivered same-image abrupt recovery and explicit cross-version rollback limitation; publish docs and update existing capability.infotech.headless-browser managed availability; read back discovery."
|
||||
}
|
||||
],
|
||||
"first_executable_milestone": "M1: prepared config/playwright candidates and existing owner requests are immediately reviewable; exact source task/acceptance returns are missing.",
|
||||
|
|
@ -134,5 +164,17 @@
|
|||
"Client disablement stops issuance; existing JWTs persist to expiry and active connections require termination.",
|
||||
"No foreign task statuses changed or owner approvals invented; no workers injected."
|
||||
],
|
||||
"availability_observed": "Managed pilot running; conditional consumer access. Local provider discovery published via finished REUSE-WP-0024; final managed availability pending."
|
||||
"availability_observed": "Managed pilot and same-image abrupt recovery verified; real consumer identity/transport and final managed availability remain pending. Local provider discovery is published.",
|
||||
"owner_progress": [
|
||||
{
|
||||
"message_id": "a2449fe0-ba12-47b8-9ca3-d7deedc089c3",
|
||||
"repo": "rapp-playwright",
|
||||
"commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
|
||||
"accepted_scope": "Local and managed same-image abrupt interruption/recovery; active and queued work interrupted, orphan PNG removed, completed hashes retained, fresh responsive/keyboard trial passed.",
|
||||
"review_scope": "Reviewed committed provider report and local/managed/failure receipts; coordinator did not repeat a live crash.",
|
||||
"first_transport_failure_retained": true,
|
||||
"identity_acceptance": false,
|
||||
"cross_version_rollback": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -436,6 +436,22 @@ a live diagnostic needs separate owner admission. Native estate acceptance and
|
|||
remaining LDAP/realm/inventory work stay open. Receipt:
|
||||
`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`.
|
||||
|
||||
2026-10-13 continuation: realm/bootstrap source repaired in NetKingdom
|
||||
`30f0d2784018daa98e36e7c1042d4e2138a05a7c`. Reproduced old credential-file command execution
|
||||
using a disposable marker; the replacement parses the same bytes literally.
|
||||
Attended passwords stay in memory. Preview/explicit apply repairs missing core
|
||||
configuration while preserving bind credentials, custom tuning, realm bindings,
|
||||
defaults and owner-managed MFA policies; broad legacy policy replay is removed.
|
||||
The console and guides use the supported flow, including fresh functional MFA
|
||||
proof. Shared transport blocks unapproved origins, redirects/proxies and raw
|
||||
error propagation. Actual privacyIDEA 3.12.2 proves minimal resolver updates
|
||||
preserve omitted fields, correcting the old general replacement claim.
|
||||
Frozen source passed all 723 tests with zero skips; four upstream deprecation
|
||||
warnings. All 16 committed blobs match the test binding. Native/PTY/regression
|
||||
receipts and limits: `docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json`.
|
||||
No live provider or credential change. Remaining LDAP/incident-cutover callers,
|
||||
full inventory and owner-approved native recovery keep NK-WP-0049 and G08 open.
|
||||
|
||||
## Verify native closure against every requirement
|
||||
|
||||
```task
|
||||
|
|
@ -490,3 +506,15 @@ permission, browser, lifecycle and recovery receipts, supported consumer docs,
|
|||
and the maintained managed-availability discovery update. Message delivery alone
|
||||
does not close this task. No new access gateway, shared administrator kubeconfig,
|
||||
shared workstation SSH identity, or broader target/permission grant is required.
|
||||
|
||||
2026-10-13 provider recovery return accepted for coordination:
|
||||
`a2449fe0-ba12-47b8-9ca3-d7deedc089c3`, rapp-playwright commit
|
||||
`2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. Reviewed committed local/managed
|
||||
SIGKILL, partial-artifact cleanup, completed-hash preservation and fresh browser
|
||||
trial receipts, including the initial transport failure. Same-image abrupt
|
||||
recovery is delivered; no crash was repeated by the coordinator. Case references
|
||||
and dependency wording now retain the narrower live gap: exact registration,
|
||||
custody, native JWT authenticator and per-caller transport owner revisions, then
|
||||
real human/agent trials and managed acceptance/discovery. Cross-version rollback
|
||||
remains explicitly unproven in provider T01. No foreign task status was changed;
|
||||
this task stays progress and no membership decision is reopened.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue