From 80a6204f7e79d28f27a3f6ce62e140002d259c1e Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 00:45:03 +0200 Subject: [PATCH] USER-WP-0028-T03: prepare attended U05-U08 MFA run for tegwick Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 629164@bnt-lap001 Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720 --- docs/mfa-attended-run.md | 86 +++++++++++++++++++ .../USER-WP-0028-user-journey-acceptance.md | 7 ++ 2 files changed, 93 insertions(+) create mode 100644 docs/mfa-attended-run.md diff --git a/docs/mfa-attended-run.md b/docs/mfa-attended-run.md new file mode 100644 index 0000000..e023e2e --- /dev/null +++ b/docs/mfa-attended-run.md @@ -0,0 +1,86 @@ +# Attended MFA acceptance run: U05–U08, first real user tegwick + +Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message +ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub +decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md). + +## What already exists + +- **Enrollment surface.** privacyIDEA self-service runs at + `https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`). + Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets + any user in that realm enroll, delete or disable their own TOTP token. Tokens + are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows + `tegwick@coulomb`. +- **Portal guidance.** `/security` explains setup, cancellation, a rejected + code and a lost authenticator. It also covers the no-factor-yet case. Until + `USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and + points to the tenant administrator. +- **Recovery and replacement.** P04 recovery and P06 policy are deployed and + were verified with installed-provider fixtures + ([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)). + +What is missing is a real person going through it, plus the portal handoff +link. + +## Does tegwick need to join the coulomb-social pilot? + +Not to enroll. Enrollment is per realm, not per client. Joining is needed only +to observe U05 and U07 on the pilot client, where MFA is optional. On +`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in +(U05) cannot be observed there. **Recommendation:** add tegwick to the +coulomb-social pilot if they are not already in it, so all four journeys run on +one client. `openbao-admin` then serves as the second U07 check that ops-mason +needs (MASON-WP-0005-T05). + +## Before the run (operator, needs the founder's go) + +1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/` + in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The + portal accepts only a fixed HTTPS URL with no query or credentials. Without + this step, start U06 at the provider URL directly and record that the handoff + was not exercised. +2. Confirm tegwick has no active token: privacyIDEA admin token list for + `tegwick@coulomb`, token count only. + +## Attended steps (tegwick at the keyboard, operator observing) + +| Step | Journey | Where | Expected | Record | +| --- | --- | --- | --- | --- | +| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome | +| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) | +| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome | +| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status | +| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client | +| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome | + +Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick +has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later. + +## Evidence rules + +Record times, outcomes, client ids, token serial suffixes and recovery record +ids in `docs/evidence/-mfa-attended-u05-u08.md`. **Never** record a seed, +a QR code or image, an OTP value, a password or a session cookie, and do not +take screenshots of the enrollment page. No step is inferred from a redirect, +a return parameter or an assurance claim. + +## After acceptance + +Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP +user in realm `coulomb` and every KeyCape client, because enrollment does not +depend on the client. MFA stays optional except where KeyCape already asks for +it (`openbao-admin`). + +Still deferred: + +- admin-required MFA, which would be an issuer-side client policy applied + through P06 and needs the founder's go; +- showing authoritative enrollment status in the portal; +- a link from KeyCape's OTP prompt to `/security` for users who have no factor + yet. That page belongs to key-cape, and today it is the dead end tegwick hit. + +## Hand-off + +USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the +recorded evidence. diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index 7f27244..c0aa729 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -84,3 +84,10 @@ the issuer plus user-engine. Admin-required MFA is deferred and would be an issuer-side client policy. The attended run accepts U05-U08 for a coulomb-social user: optional enrollment, then return, then lost-factor recovery. cef97ccd stays open for that acceptance. + +2026-10-10: founder asked (via ops-mason, hub ab89a591) for self-service MFA +setup for all users, with tegwick as the first attended run. The run is +prepared in docs/mfa-attended-run.md. It covers the start point, the attended +steps, evidence rules (no seeds, codes or QR), the handoff URL and what stays +deferred. It needs the founder's go to set USER_ENGINE_MFA_MANAGEMENT_URL, and +a decision on whether tegwick joins the coulomb-social pilot.