tegwick
3bd1827a7f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
35 lines
1.9 KiB
Markdown
35 lines
1.9 KiB
Markdown
# P06 authentication policy acceptance
|
|
|
|
Scoped to `vergabe-demo-company` and `user-engine-portal`. The issuer owns
|
|
persistent policy, revision-bound previews, acknowledged apply, durable receipts
|
|
and reviewed rollback. Explicit application AAL2 remains authoritative. Portal
|
|
administration requires MFA; policy and factor recovery require recent MFA.
|
|
|
|
Optional means password-only until a confirmed active authenticator exists.
|
|
Provider lookup failures deny login. Pending setup can be cancelled; active
|
|
factor replacement requires audited recovery, including from old AAL1 sessions.
|
|
|
|
## Verification
|
|
|
|
- Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
|
|
- Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
|
|
- Issuer policy/runtime regression tests passed; two policy rollout and one
|
|
provider guard deployment tests passed.
|
|
- Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
|
|
confirms no-factor/pending login, activation, old-session MFA, explicit AAL2
|
|
and successful OTP sign-in. Five browser checks pass: correct identity,
|
|
pending possession proof, cancellation, confirmed activation and denied
|
|
replacement with a visible recovery route.
|
|
- Provider image: `ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473`.
|
|
|
|
Fixture repairs submit OTP to `/authorize/callback`, wait for asynchronous TOTP
|
|
selection, and wait for loaded pending state and an enabled Delete button.
|
|
The fixture uses disposable databases and synthetic identities, with no
|
|
production account changes. Reproduce using key-cape
|
|
`scripts/provider_browser_acceptance.py` and user-engine
|
|
`scripts/browser_journeys.py`.
|
|
|
|
## Release
|
|
|
|
Pending CI image publication and ordered live rollout. Do not infer deployment
|
|
or complete platform journey acceptance from these test results.
|