87 lines
4.6 KiB
Markdown
87 lines
4.6 KiB
Markdown
|
# Attended MFA acceptance run: U05–U08, first real user tegwick
|
|||
|
|
|
|||
|
|
Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message
|
|||
|
|
ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub
|
|||
|
|
decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md).
|
|||
|
|
|
|||
|
|
## What already exists
|
|||
|
|
|
|||
|
|
- **Enrollment surface.** privacyIDEA self-service runs at
|
|||
|
|
`https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`).
|
|||
|
|
Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets
|
|||
|
|
any user in that realm enroll, delete or disable their own TOTP token. Tokens
|
|||
|
|
are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows
|
|||
|
|
`tegwick@coulomb`.
|
|||
|
|
- **Portal guidance.** `/security` explains setup, cancellation, a rejected
|
|||
|
|
code and a lost authenticator. It also covers the no-factor-yet case. Until
|
|||
|
|
`USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and
|
|||
|
|
points to the tenant administrator.
|
|||
|
|
- **Recovery and replacement.** P04 recovery and P06 policy are deployed and
|
|||
|
|
were verified with installed-provider fixtures
|
|||
|
|
([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)).
|
|||
|
|
|
|||
|
|
What is missing is a real person going through it, plus the portal handoff
|
|||
|
|
link.
|
|||
|
|
|
|||
|
|
## Does tegwick need to join the coulomb-social pilot?
|
|||
|
|
|
|||
|
|
Not to enroll. Enrollment is per realm, not per client. Joining is needed only
|
|||
|
|
to observe U05 and U07 on the pilot client, where MFA is optional. On
|
|||
|
|
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
|
|||
|
|
(U05) cannot be observed there. **Recommendation:** add tegwick to the
|
|||
|
|
coulomb-social pilot if they are not already in it, so all four journeys run on
|
|||
|
|
one client. `openbao-admin` then serves as the second U07 check that ops-mason
|
|||
|
|
needs (MASON-WP-0005-T05).
|
|||
|
|
|
|||
|
|
## Before the run (operator, needs the founder's go)
|
|||
|
|
|
|||
|
|
1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
|
|||
|
|
in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The
|
|||
|
|
portal accepts only a fixed HTTPS URL with no query or credentials. Without
|
|||
|
|
this step, start U06 at the provider URL directly and record that the handoff
|
|||
|
|
was not exercised.
|
|||
|
|
2. Confirm tegwick has no active token: privacyIDEA admin token list for
|
|||
|
|
`tegwick@coulomb`, token count only.
|
|||
|
|
|
|||
|
|
## Attended steps (tegwick at the keyboard, operator observing)
|
|||
|
|
|
|||
|
|
| Step | Journey | Where | Expected | Record |
|
|||
|
|
| --- | --- | --- | --- | --- |
|
|||
|
|
| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome |
|
|||
|
|
| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
|
|||
|
|
| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
|
|||
|
|
| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
|
|||
|
|
| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
|
|||
|
|
| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |
|
|||
|
|
|
|||
|
|
Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
|
|||
|
|
has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.
|
|||
|
|
|
|||
|
|
## Evidence rules
|
|||
|
|
|
|||
|
|
Record times, outcomes, client ids, token serial suffixes and recovery record
|
|||
|
|
ids in `docs/evidence/<date>-mfa-attended-u05-u08.md`. **Never** record a seed,
|
|||
|
|
a QR code or image, an OTP value, a password or a session cookie, and do not
|
|||
|
|
take screenshots of the enrollment page. No step is inferred from a redirect,
|
|||
|
|
a return parameter or an assurance claim.
|
|||
|
|
|
|||
|
|
## After acceptance
|
|||
|
|
|
|||
|
|
Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP
|
|||
|
|
user in realm `coulomb` and every KeyCape client, because enrollment does not
|
|||
|
|
depend on the client. MFA stays optional except where KeyCape already asks for
|
|||
|
|
it (`openbao-admin`).
|
|||
|
|
|
|||
|
|
Still deferred:
|
|||
|
|
|
|||
|
|
- admin-required MFA, which would be an issuer-side client policy applied
|
|||
|
|
through P06 and needs the founder's go;
|
|||
|
|
- showing authoritative enrollment status in the portal;
|
|||
|
|
- a link from KeyCape's OTP prompt to `/security` for users who have no factor
|
|||
|
|
yet. That page belongs to key-cape, and today it is the dead end tegwick hit.
|
|||
|
|
|
|||
|
|
## Hand-off
|
|||
|
|
|
|||
|
|
USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the
|
|||
|
|
recorded evidence.
|