security: retain scoped MFA diagnostic evidence and remaining owner boundaries
This commit is contained in:
codex
parent
3a850beb06
commit
f18c7579f0
2 changed files with 137 additions and 0 deletions
|
|
@ -0,0 +1,121 @@
|
|||
{
|
||||
"observed_at": "2026-10-13",
|
||||
"source_repo": "net-kingdom",
|
||||
"source_base": "1cbe00fd78e60ac70f2ea7957a0e1d7477388dcf",
|
||||
"source_commit": "96feef46ab22811e3736231f04818655ca7b834e",
|
||||
"workplan_id": "NK-WP-0049",
|
||||
"task_id": "NK-WP-0049-T02",
|
||||
"custodian_task_id": "CUST-WP-0080-T03",
|
||||
"result": "Scoped diagnostic source repaired; no new live credential delivery admitted",
|
||||
"changes": [
|
||||
"Removed retired keycape-pi-token Secret retrieval, TLS bypass, credential argv and raw provider-error output.",
|
||||
"Explicit owned/private regular JWT file outside Git; input and destination checks precede transport. No issuance, retrieval, renewal or fallback.",
|
||||
"Canonical HTTPS or explicit literal loopback, system CA validation, no redirects or ambient proxy/CA overrides, bounded responses.",
|
||||
"Only token listing in coulomb, inert realm visibility probe before/after, complete bounded counts with confirmed/pending/inactive distinction.",
|
||||
"Guide and non-root dry-run require admitted private input; selected user checked rather than hard-coded platform-root."
|
||||
],
|
||||
"files": [
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/mfa_state.py",
|
||||
"sha256": "3f0c2e404d7df41af7f8e1fe66a4a6d392338391456ef298c7dd0219ad3d58dc"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh",
|
||||
"sha256": "18901decfdc974ba5a6e871b7a4fe8022be59c73123774a31c57303fd5f657be"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_mfa_state_diagnostic.py",
|
||||
"sha256": "1b91c8f437197ea01ac814ffd11b673e5b9cfb45b2a20e94ea6b1085c8137863"
|
||||
},
|
||||
{
|
||||
"path": "tests/mfa_state_native_fixture.py",
|
||||
"sha256": "1a0bfa15cf33fab329327af7ec44efd9596c43f82aa0670900f08793125040db"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/privacyidea/README.md",
|
||||
"sha256": "879d4eca4758fedd976adec31401376c854485459a2a4c4b35e6de11b2a1c941"
|
||||
},
|
||||
{
|
||||
"path": "docs/smooth-bootstrap-guide.md",
|
||||
"sha256": "24c4bc69b6750997113f666528157d1821e908fa83dc7c9937088a8ba6ef8aae"
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh",
|
||||
"sha256": "3839cd1f4ea3fb344b9803eca7646974b7c1029a8c876be585ce52a4c631766d"
|
||||
},
|
||||
{
|
||||
"path": "docs/attended-procedure-inventory.md",
|
||||
"sha256": "0a08392ddac7f3d6dacc4b4666057792b7b80a0d992f28d04262725a1e2d5950"
|
||||
},
|
||||
{
|
||||
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"sha256": "3e5aea59b0fb8cb51ae0e5162ab2d73ef5d390f526dc5587aa3d73f1f040fd6b"
|
||||
}
|
||||
],
|
||||
"verification": {
|
||||
"focused": "55 passed",
|
||||
"full_suite": "1 failed, 685 passed, 4 warnings in 540.61s (0:09:00)",
|
||||
"unchanged_timing_module_rerun": "46 passed in 4.61s",
|
||||
"full_run_failure": {
|
||||
"test": "test_oversized_body_slow_abort_remains_unproved_and_bounded",
|
||||
"observed_seconds": 0.05048932199861156,
|
||||
"limit_seconds": 0.05,
|
||||
"interpretation": "Unchanged timing assertion failed under concurrent host load; affected module rerun passed without source or threshold changes. Original full-run failure retained."
|
||||
},
|
||||
"exit_code": 1,
|
||||
"source_unchanged_during_run": true,
|
||||
"elapsed_seconds": 490.43,
|
||||
"command": [
|
||||
"/tmp/nk-pi-key-native/bin/python",
|
||||
"-m",
|
||||
"pytest",
|
||||
"-q",
|
||||
"tests",
|
||||
"tools",
|
||||
"sso-mfa/k8s/keycape",
|
||||
"--tb=short",
|
||||
"-rs"
|
||||
],
|
||||
"binding_sha256": "25141be59a80f750a71218883d5910904b02122e8e0e88ba87ff732a53f4b675",
|
||||
"log_sha256": "319f67568215075fcd52c3842f011f0b2a2eaf43fbe6b3c8b0bddaa1a0cadc7c",
|
||||
"native_privacyidea_version": "3.12.2",
|
||||
"native_results": {
|
||||
"native_counts_beyond_default_page": true,
|
||||
"native_empty_with_visibility": true,
|
||||
"native_expired_provider_jwt_refused": true,
|
||||
"native_permission_recovery": true,
|
||||
"native_self_service_cannot_prove_other_user_visibility": true,
|
||||
"native_tampered_signature_refused": true,
|
||||
"native_withdrawal_empty_success_refused": true
|
||||
},
|
||||
"applied_files_match_test_binding": true,
|
||||
"shell_syntax": "passed",
|
||||
"initial_failures": [
|
||||
{
|
||||
"result": "9 failed, 44 passed",
|
||||
"disposition": "Corrected overbroad empty .git directory detection; set compact oversized-response test ID to prevent pytest environment exceeding exec limit."
|
||||
},
|
||||
{
|
||||
"result": "Native fixture assertion failures retained in temporary logs",
|
||||
"disposition": "Corrected pending-state model field and local-admin lifetime policy fixture, then repeated against actual provider-issued tokens. No provider failure relabeled as success."
|
||||
}
|
||||
],
|
||||
"committed_files_match_test_binding": true
|
||||
},
|
||||
"owner_boundary": {
|
||||
"source": "railiance-platform/docs/net-kingdom-credential-custody-contract.md",
|
||||
"existing_lane_consumer": "KeyCape only",
|
||||
"diagnostic_delivery": "Separate owner-admitted execution/input required; not established by this source repair",
|
||||
"historical_admin_resolver_lanes": "Remain separately blocked; no secret coordinates invented"
|
||||
},
|
||||
"limits": [
|
||||
"No live credential/Secret, user factor, provider policy or workload was read or changed.",
|
||||
"Disposable SQLite/provider HTTP tests do not establish deployed-image or production acceptance.",
|
||||
"Zero count does not prove user existence; counts do not prove successful MFA authentication.",
|
||||
"Three HTTP observations are not an atomic policy/factor snapshot; maximum complete result is 1000 tokens.",
|
||||
"Explicit HTTP loopback relies on the reviewed local process/forward; same-UID host isolation is not claimed.",
|
||||
"Credential expiry/signature remains server-verified; structural JWT preflight is not independent signature validation.",
|
||||
"Remaining LDAP/realm callers, complete inventory, historical revocation and native off-host recovery remain open."
|
||||
],
|
||||
"upstream_reference": "https://privacyidea.readthedocs.io/en/v3.12.1/modules/api/token.html"
|
||||
}
|
||||
|
|
@ -421,6 +421,21 @@ or off-host recovery acceptance. NK-WP-0049-T02 remains progress for remaining
|
|||
callers/inventory; T03 remains wait for owner-approved native recovery. Receipt:
|
||||
`docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json`.
|
||||
|
||||
2026-10-13 continuation: bounded MFA-state diagnostic published in NetKingdom
|
||||
`96feef46ab22811e3736231f04818655ca7b834e`. Removed retired Secret reads, insecure TLS, token argv
|
||||
and raw provider errors. Explicit protected input, scoped token listing, inert
|
||||
realm visibility proof before/after and complete counts distinguish confirmed,
|
||||
pending and inactive factors. Real privacyIDEA 3.12.2 reproduces HTTP-200 empty
|
||||
results after permission withdrawal; the diagnostic refuses them and accepts
|
||||
permission recovery. Real self-service, tampered and expired tokens are refused.
|
||||
Focused55 pass; full suite 1 failed, 685 passed, 4 warnings in 540.61s (0:09:00). One unchanged 50ms abort timing
|
||||
assertion missed by 0.49ms; all46 tests in that module pass on unchanged rerun.
|
||||
The original failure remains in the receipt. All nine applied paths match
|
||||
the frozen test binding. KeyCape's workload delivery is not shared or expanded;
|
||||
a live diagnostic needs separate owner admission. Native estate acceptance and
|
||||
remaining LDAP/realm/inventory work stay open. Receipt:
|
||||
`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`.
|
||||
|
||||
## Verify native closure against every requirement
|
||||
|
||||
```task
|
||||
|
|
@ -444,6 +459,7 @@ id: CUST-WP-0080-T05
|
|||
status: progress
|
||||
priority: high
|
||||
depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004]
|
||||
state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b"
|
||||
```
|
||||
|
||||
User-requested addition on 2026-10-13. Accountable coordinating owner:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue