coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement scoped P06 authentication policy and guarded optional onboarding
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
Build and Publish Container Image / build-and-push (push) Successful in 51s
Details
Account journey acceptance / journeys (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:00:07 +02:00
parent 0801ec55ac
commit 3bd1827a7f
10 changed files with 298 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/evidence/2026-09-13-p06-authentication-policy.md Normal file
View file

@ -0,0 +1,35 @@
# P06 authentication policy acceptance
Scoped to `vergabe-demo-company` and `user-engine-portal`. The issuer owns
persistent policy, revision-bound previews, acknowledged apply, durable receipts
and reviewed rollback. Explicit application AAL2 remains authoritative. Portal
administration requires MFA; policy and factor recovery require recent MFA.
Optional means password-only until a confirmed active authenticator exists.
Provider lookup failures deny login. Pending setup can be cancelled; active
factor replacement requires audited recovery, including from old AAL1 sessions.
## Verification
- Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
- Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
- Issuer policy/runtime regression tests passed; two policy rollout and one
provider guard deployment tests passed.
- Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
confirms no-factor/pending login, activation, old-session MFA, explicit AAL2
and successful OTP sign-in. Five browser checks pass: correct identity,
pending possession proof, cancellation, confirmed activation and denied
replacement with a visible recovery route.
- Provider image: `ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473`.
Fixture repairs submit OTP to `/authorize/callback`, wait for asynchronous TOTP
selection, and wait for loaded pending state and an enabled Delete button.
The fixture uses disposable databases and synthetic identities, with no
production account changes. Reproduce using key-cape
`scripts/provider_browser_acceptance.py` and user-engine
`scripts/browser_journeys.py`.
## Release
Pending CI image publication and ordered live rollout. Do not infer deployment
or complete platform journey acceptance from these test results.