security: retain native LDAP group maintenance verification
This commit is contained in:
codex
parent
880c224a4b
commit
c53ebce2b7
2 changed files with 128 additions and 0 deletions
|
|
@ -0,0 +1,108 @@
|
|||
{
|
||||
"observed_at": "2026-10-14",
|
||||
"source_repo": "net-kingdom",
|
||||
"source_base": "e861f63513859d5240773ce72e162b303fa7b9e4",
|
||||
"workplan_id": "NK-WP-0049",
|
||||
"task_id": "NK-WP-0049-T02",
|
||||
"custodian_task_id": "CUST-WP-0080-T03",
|
||||
"result": "ldap_group_callers_reconciled_with_isolated_native_proof_not_estate_acceptance",
|
||||
"files": {
|
||||
"docs/attended-procedure-inventory.md": "9b3cde4de1f6410c105d608f7ff45774862c50dd72535aff5b131f8528357ab3",
|
||||
"docs/legacy-lldap-lifecycle-retirement.md": "996d562989516beb1830232fb7c77800c6ae4b033883c6d5760fc4f93cdb107e",
|
||||
"sso-mfa/WORKPLAN.md": "6a88e36c8e82b447e1297e970ee429ba066a42605771520d352cf899e844dc10",
|
||||
"sso-mfa/k8s/backup/DR-RUNBOOK.md": "4a5227703fca967fb550a93682ad20310b3c7cdf792736682d7067e0d8df8353",
|
||||
"sso-mfa/k8s/keycape/README.md": "9571e99a535b1a26999e7fc3bfe22185dd3014d101c328300f57dde44d014522",
|
||||
"sso-mfa/k8s/lldap/OPERATOR-GROUPS.md": "7adfea8205fd3e6a98d9c2c49032f17bc67dcf8e3bc9e39c1d940be714c32798",
|
||||
"sso-mfa/k8s/lldap/README.md": "44ad28585ddbe1ab2eeb299246f1dbec2a186b71fa67b9b874780662216ffc6a",
|
||||
"sso-mfa/k8s/lldap/bootstrap-users.sh": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6",
|
||||
"sso-mfa/k8s/lldap/manage-group-members.sh": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1",
|
||||
"sso-mfa/k8s/verify-t07.sh": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df",
|
||||
"workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "099fe590e7cbc5b2bda7b2da5f2e083ab0305bb3bdde60f02de785efbe301358",
|
||||
"sso-mfa/k8s/lldap/lldap_admin.py": "80a353b4a452267be32ffc7f4ece7f7b727a18778575444b93177425b4f660e3",
|
||||
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md": "61618e61d077bae00daa4ea77ebd3af124810c1047d90832b3f1b351f3b46a22",
|
||||
"tests/test_lldap_group_maintenance.py": "ab9c3620b8f779b258aabf742d678860d647be55c307abf112925a8b817f0c18",
|
||||
"tests/lldap_groups_native_fixture.py": "19ce0721671114b632ffc4215cb1ebe5349354e1666942bccd4a500b8cb0a1d1"
|
||||
},
|
||||
"unchanged_dependencies": [
|
||||
{
|
||||
"path": "identity-provisioner/provisioner.py",
|
||||
"sha256": "bac0069de2552a2f226d788ab9891ab9362c65244e7cdf13e8b20d2c569e4618"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/bootstrap/apply-service-secrets.py",
|
||||
"sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b"
|
||||
}
|
||||
],
|
||||
"verification": {
|
||||
"baseline": {
|
||||
"failed": 3,
|
||||
"description": "Old bootstrap, membership and T07 scripts executed supplied credential-file shell code; curl/kubectl were controlled stubs, credentials synthetic."
|
||||
},
|
||||
"affected_tests": {
|
||||
"run": 200,
|
||||
"failures": 0,
|
||||
"errors": 0,
|
||||
"skipped": 0,
|
||||
"scope": "LDAP maintenance, retired lifecycle, private service custody and identity-provisioner suites"
|
||||
},
|
||||
"native": {
|
||||
"image": "sha256:2a8454b668c1aba7157e832eab0e242e1e7eb5fb7591d7e7774ba05286511ca8",
|
||||
"synthetic_only": true,
|
||||
"checks": {
|
||||
"preview_nonmutating": true,
|
||||
"bootstrap_exact_and_existing_preserved": true,
|
||||
"bootstrap_idempotent": true,
|
||||
"exact_add_and_readback": true,
|
||||
"exact_remove_and_readback": true,
|
||||
"reserved_group_refusal_preserves_state": true,
|
||||
"stale_preview_refused": true,
|
||||
"t07_structural_only_exit_and_no_trace_disclosure": true,
|
||||
"fixture_removed": true
|
||||
},
|
||||
"outcome": "passed"
|
||||
},
|
||||
"applied_files_match_manifest": true,
|
||||
"changed_shell_syntax": "passed",
|
||||
"git_diff_check": "passed",
|
||||
"log_digests": {
|
||||
"baseline.log": "384f2dfaaec9435d2f9fd372008afd97dec4de67555b1edbd28963a31534e828",
|
||||
"focused-tests.log": "a3445b5a3491588d8202dfd42aecdc9b564491495debdaab83bfc0cfc44e3bfc",
|
||||
"http-tests.log": "5be5939bc6eb2e47ece63dd138aa35f763056c33e68889110981fb4211874d30",
|
||||
"affected-tests.log": "0f0fd49b9d98ad9a1e30418ee2d6e5f130b30b73eb7e18ce3c9baf7f04becb5e",
|
||||
"native.json": "be4673cc4f6aa9e0eebee3b37a670dfcc7611fa71d8b7564e6a092818710e9a9"
|
||||
},
|
||||
"secret_scan": {
|
||||
"status": "clean",
|
||||
"changed_blobs": 15,
|
||||
"version": "8.30.1"
|
||||
},
|
||||
"evidence_scan_triage": {
|
||||
"rule": "generic-api-key",
|
||||
"blocked_blob_id": "5f3edfcd46698972a32415aee0005c424b00a7ed",
|
||||
"classification": "false_positive_public_source_sha256",
|
||||
"verification": "Flagged value exactly equals SHA256 of the committed apply-service-secrets.py dependency at source_base. Dependency entries now separate path and sha256 fields; scanner policy unchanged."
|
||||
}
|
||||
},
|
||||
"behavior": [
|
||||
"Three shell entry points disable tracing and delegate to the shared adapter; existing provider operations and literal private-custody reader are reused.",
|
||||
"Explicit outside-Git private custody; no ambient admin-password fallback, shell sourcing, auto Secret discovery, curl/kubectl, credentials in child argv or KeyCape configuration Secret reads.",
|
||||
"Fixed HTTPS origin or explicit literal-loopback port; system trust, no redirects or ambient proxies; bounded strict JSON and contained diagnostics.",
|
||||
"Bootstrap previews only missing fixed empty baseline groups; service membership uses an existing exact user/group and refuses reserved namespaces before login.",
|
||||
"Apply binds origin/operation/target/observed state, checks again before first write and requires exact final preservation; stale or mismatched state refuses.",
|
||||
"T07 emits only observed directory structure and explicit unverified native acceptance with exit 2; input/protocol/authentication failure exits 1."
|
||||
],
|
||||
"limits": [
|
||||
"LLDAP has no cross-query compare-and-swap here. An owner-controlled exclusive maintenance window is required; preview digests confer no approval or runtime isolation.",
|
||||
"Multiple group creations can leave partial changes on failure. No blind rollback/retry or group deletion; owner must reconcile current state.",
|
||||
"Local native fixture used an immutable existing image, generated synthetic credentials and disposable storage. It does not prove the deployed estate version, current credentials or attended authority.",
|
||||
"No live estate credential, account, membership, deployment or KeyCape Secret was read or changed.",
|
||||
"Actual lifecycle/login/MFA/claims/consumer/revocation and independent recovery acceptance remain open under T03. Incident-cutover callers and full root-output/caller inventory remain under T02.",
|
||||
"Earlier provider reserved-group repair still requires owner-scoped deployment/native enforcement verification."
|
||||
],
|
||||
"knowledge_orientation": {
|
||||
"version": "0.2.6",
|
||||
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld/source-changed/orientation-only; current provider, caller, custody and verification-audit sources reviewed"
|
||||
},
|
||||
"source_commit": "ab25dde80d4520c4ff09240944d1510b2a17b9f0"
|
||||
}
|
||||
|
|
@ -479,6 +479,26 @@ Mixed requests and delete-if-empty also refuse before login. Receipt:
|
|||
No rollout or live directory mutation; exact owner deployment and native checks
|
||||
remain necessary before claiming live enforcement. NK-WP-0049 stays active.
|
||||
|
||||
2026-10-14 LDAP group caller reconciliation delivered in NetKingdom `ab25dde`.
|
||||
Bootstrap, membership and T07 wrappers now reuse provider operations and literal
|
||||
private custody through one adapter. No executable credential sourcing, ambient
|
||||
password fallback, credential argv, curl/kubectl or KeyCape config Secret read.
|
||||
Bootstrap only creates missing empty fixed baseline groups; service membership
|
||||
requires exact existing identities/groups and refuses reserved namespaces.
|
||||
Preview/apply binds origin, operation, target and observed state; fresh prewrite
|
||||
and final exact readback preserve unrelated data. Owner-controlled exclusive
|
||||
maintenance remains necessary because LLDAP has no cross-query CAS; partial
|
||||
failures require reconciliation, not blind rollback.
|
||||
|
||||
Three old-source regressions failed; all 200 affected tests pass without skips.
|
||||
An actual isolated local immutable LLDAP image passed preview, preservation,
|
||||
idempotence, add/remove, reserved/stale refusal and T07 incomplete-exit checks.
|
||||
The synthetic fixture/container/private files were removed. T07 is explicitly
|
||||
structural-only (exit 2), not lifecycle/login/recovery acceptance. Receipt:
|
||||
`docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json`.
|
||||
No live estate change. Incident-cutover/full inventory and owner-approved native
|
||||
recovery/estate acceptance keep NK-WP-0049 and G08 open.
|
||||
|
||||
## Verify native closure against every requirement
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue