From f18c7579f0233fec25089d4aff5bedc9fbae9bf3 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 13 Oct 2026 22:26:46 +0200 Subject: [PATCH] security: retain scoped MFA diagnostic evidence and remaining owner boundaries --- .../mfa-state-diagnostic.json | 121 ++++++++++++++++++ ...gdom-security-blueprint-and-gap-closure.md | 16 +++ 2 files changed, 137 insertions(+) create mode 100644 docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json diff --git a/docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json b/docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json new file mode 100644 index 00000000..a00ee2f9 --- /dev/null +++ b/docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json @@ -0,0 +1,121 @@ +{ + "observed_at": "2026-10-13", + "source_repo": "net-kingdom", + "source_base": "1cbe00fd78e60ac70f2ea7957a0e1d7477388dcf", + "source_commit": "96feef46ab22811e3736231f04818655ca7b834e", + "workplan_id": "NK-WP-0049", + "task_id": "NK-WP-0049-T02", + "custodian_task_id": "CUST-WP-0080-T03", + "result": "Scoped diagnostic source repaired; no new live credential delivery admitted", + "changes": [ + "Removed retired keycape-pi-token Secret retrieval, TLS bypass, credential argv and raw provider-error output.", + "Explicit owned/private regular JWT file outside Git; input and destination checks precede transport. No issuance, retrieval, renewal or fallback.", + "Canonical HTTPS or explicit literal loopback, system CA validation, no redirects or ambient proxy/CA overrides, bounded responses.", + "Only token listing in coulomb, inert realm visibility probe before/after, complete bounded counts with confirmed/pending/inactive distinction.", + "Guide and non-root dry-run require admitted private input; selected user checked rather than hard-coded platform-root." + ], + "files": [ + { + "path": "sso-mfa/k8s/privacyidea/mfa_state.py", + "sha256": "3f0c2e404d7df41af7f8e1fe66a4a6d392338391456ef298c7dd0219ad3d58dc" + }, + { + "path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh", + "sha256": "18901decfdc974ba5a6e871b7a4fe8022be59c73123774a31c57303fd5f657be" + }, + { + "path": "tests/test_mfa_state_diagnostic.py", + "sha256": "1b91c8f437197ea01ac814ffd11b673e5b9cfb45b2a20e94ea6b1085c8137863" + }, + { + "path": "tests/mfa_state_native_fixture.py", + "sha256": "1a0bfa15cf33fab329327af7ec44efd9596c43f82aa0670900f08793125040db" + }, + { + "path": "sso-mfa/k8s/privacyidea/README.md", + "sha256": "879d4eca4758fedd976adec31401376c854485459a2a4c4b35e6de11b2a1c941" + }, + { + "path": "docs/smooth-bootstrap-guide.md", + "sha256": "24c4bc69b6750997113f666528157d1821e908fa83dc7c9937088a8ba6ef8aae" + }, + { + "path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh", + "sha256": "3839cd1f4ea3fb344b9803eca7646974b7c1029a8c876be585ce52a4c631766d" + }, + { + "path": "docs/attended-procedure-inventory.md", + "sha256": "0a08392ddac7f3d6dacc4b4666057792b7b80a0d992f28d04262725a1e2d5950" + }, + { + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "sha256": "3e5aea59b0fb8cb51ae0e5162ab2d73ef5d390f526dc5587aa3d73f1f040fd6b" + } + ], + "verification": { + "focused": "55 passed", + "full_suite": "1 failed, 685 passed, 4 warnings in 540.61s (0:09:00)", + "unchanged_timing_module_rerun": "46 passed in 4.61s", + "full_run_failure": { + "test": "test_oversized_body_slow_abort_remains_unproved_and_bounded", + "observed_seconds": 0.05048932199861156, + "limit_seconds": 0.05, + "interpretation": "Unchanged timing assertion failed under concurrent host load; affected module rerun passed without source or threshold changes. Original full-run failure retained." + }, + "exit_code": 1, + "source_unchanged_during_run": true, + "elapsed_seconds": 490.43, + "command": [ + "/tmp/nk-pi-key-native/bin/python", + "-m", + "pytest", + "-q", + "tests", + "tools", + "sso-mfa/k8s/keycape", + "--tb=short", + "-rs" + ], + "binding_sha256": "25141be59a80f750a71218883d5910904b02122e8e0e88ba87ff732a53f4b675", + "log_sha256": "319f67568215075fcd52c3842f011f0b2a2eaf43fbe6b3c8b0bddaa1a0cadc7c", + "native_privacyidea_version": "3.12.2", + "native_results": { + "native_counts_beyond_default_page": true, + "native_empty_with_visibility": true, + "native_expired_provider_jwt_refused": true, + "native_permission_recovery": true, + "native_self_service_cannot_prove_other_user_visibility": true, + "native_tampered_signature_refused": true, + "native_withdrawal_empty_success_refused": true + }, + "applied_files_match_test_binding": true, + "shell_syntax": "passed", + "initial_failures": [ + { + "result": "9 failed, 44 passed", + "disposition": "Corrected overbroad empty .git directory detection; set compact oversized-response test ID to prevent pytest environment exceeding exec limit." + }, + { + "result": "Native fixture assertion failures retained in temporary logs", + "disposition": "Corrected pending-state model field and local-admin lifetime policy fixture, then repeated against actual provider-issued tokens. No provider failure relabeled as success." + } + ], + "committed_files_match_test_binding": true + }, + "owner_boundary": { + "source": "railiance-platform/docs/net-kingdom-credential-custody-contract.md", + "existing_lane_consumer": "KeyCape only", + "diagnostic_delivery": "Separate owner-admitted execution/input required; not established by this source repair", + "historical_admin_resolver_lanes": "Remain separately blocked; no secret coordinates invented" + }, + "limits": [ + "No live credential/Secret, user factor, provider policy or workload was read or changed.", + "Disposable SQLite/provider HTTP tests do not establish deployed-image or production acceptance.", + "Zero count does not prove user existence; counts do not prove successful MFA authentication.", + "Three HTTP observations are not an atomic policy/factor snapshot; maximum complete result is 1000 tokens.", + "Explicit HTTP loopback relies on the reviewed local process/forward; same-UID host isolation is not claimed.", + "Credential expiry/signature remains server-verified; structural JWT preflight is not independent signature validation.", + "Remaining LDAP/realm callers, complete inventory, historical revocation and native off-host recovery remain open." + ], + "upstream_reference": "https://privacyidea.readthedocs.io/en/v3.12.1/modules/api/token.html" +} diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 2f7d8413..b5e498e4 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -421,6 +421,21 @@ or off-host recovery acceptance. NK-WP-0049-T02 remains progress for remaining callers/inventory; T03 remains wait for owner-approved native recovery. Receipt: `docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json`. +2026-10-13 continuation: bounded MFA-state diagnostic published in NetKingdom +`96feef46ab22811e3736231f04818655ca7b834e`. Removed retired Secret reads, insecure TLS, token argv +and raw provider errors. Explicit protected input, scoped token listing, inert +realm visibility proof before/after and complete counts distinguish confirmed, +pending and inactive factors. Real privacyIDEA 3.12.2 reproduces HTTP-200 empty +results after permission withdrawal; the diagnostic refuses them and accepts +permission recovery. Real self-service, tampered and expired tokens are refused. +Focused55 pass; full suite 1 failed, 685 passed, 4 warnings in 540.61s (0:09:00). One unchanged 50ms abort timing +assertion missed by 0.49ms; all46 tests in that module pass on unchanged rerun. +The original failure remains in the receipt. All nine applied paths match +the frozen test binding. KeyCape's workload delivery is not shared or expanded; +a live diagnostic needs separate owner admission. Native estate acceptance and +remaining LDAP/realm/inventory work stay open. Receipt: +`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`. + ## Verify native closure against every requirement ```task @@ -444,6 +459,7 @@ id: CUST-WP-0080-T05 status: progress priority: high depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] +state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b" ``` User-requested addition on 2026-10-13. Accountable coordinating owner: