user-engine/docs/evidence/2026-09-13-p06-authentication-policy.md

P06 authentication policy acceptance

Scoped to vergabe-demo-company and user-engine-portal. The issuer owns persistent policy, revision-bound previews, acknowledged apply, durable receipts and reviewed rollback. Explicit application AAL2 remains authoritative. Portal administration requires MFA; policy and factor recovery require recent MFA.

Optional means password-only until a confirmed active authenticator exists. Provider lookup failures deny login. Pending setup can be cancelled; active factor replacement requires audited recovery, including from old AAL1 sessions.

Verification

• Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
• Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
• Final platform completeness gate: 33 tests passed, zero skips, all P01–P08 marked implemented with no unresolved platform journeys. See the adjacent P06 platform-complete JSON report.
• Issuer policy/runtime regression tests passed; two policy rollout and one provider guard deployment tests passed.
• Installed privacyIDEA fixture provider-p06-browser-46713f7e: native adapter confirms no-factor/pending login, activation, old-session MFA, explicit AAL2 and successful OTP sign-in. Five browser checks pass: correct identity, pending possession proof, cancellation, confirmed activation and denied replacement with a visible recovery route.
• Provider image: ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473.

Fixture repairs submit OTP to /authorize/callback, wait for asynchronous TOTP selection, and wait for loaded pending state and an enabled Delete button. The fixture uses disposable databases and synthetic identities, with no production account changes. Reproduce using key-cape scripts/provider_browser_acceptance.py and user-engine scripts/browser_journeys.py.

Release

Completed 2026-09-14 Europe/Berlin (2026-09-13 UTC):

• KeyCape source e0b3c25; CI acceptance run 64 and image run 65 passed.
• Portal source 3bd1827; image run 178 and journey run 179 passed. Routing-only smoke run 177 was cancelled; it is not claimed as passed.
• NetKingdom policy/guard tooling: a549617.
• Portal image: forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c.
• Issuer image: forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5.

Portal guards rolled out first. Provider guard keycape-onboarding-9465e5e0b98f7986 then rolled out to privacyIDEA and recovery. Provider policy readback confirms TOTP enrollment, pending-only deletion and active-factor changes through recovery; existing tokens were unchanged. Only the two reviewed client registrations were migrated with UID/resource-version CAS and unrelated Secret bytes preserved. Issuer replacement then activated persistent policy at /var/lib/keycape-policy/policy.json on the dedicated PVC.

Read-only Job p06-policy-readback-1c0eba21 verified both effective policies are optional_after_enrollment, revision 0, no administrative changes yet. The Job was removed. Portal health/readiness and issuer readiness return 200; both policy surfaces reject anonymous access with 403. The migration inspector reports no remaining change. Receipts are in the adjacent P06 rollout JSON.

Positive policy changes/replay/rollback are tested in isolated stores and portal fixtures. No production account or real administrator policy override was used as a test. Actual invited-person and application sign-in acceptance remains in USER-WP-0028 / KEY-WP-0034 / VERGABE-WP-0019.

Operating policy and rollback

Open Platform administration → Authentication policy and verify with fresh MFA. Select a reviewed client, policy and change reference; preview the impact and acknowledge it before applying. Cancel leaves policy unchanged. A stale review requires a new preview; an uncertain response should be checked in current state and history. Rollback is a new reviewed change to that client's previous policy.

Preserve the policy PVC and receipts across issuer replacement; do not delete it during rollback. It uses this cluster's local-path storage, not multi-node HA. Before reverting to a pre-P06 portal or issuer, restore mandatory MFA for both clients in runtime policy and the baseline client registrations, verify it, then restore the previous image pins. Keep the provider active-factor guard and recovery service. Reverting the portal guards while optional login remains active would weaken administration. Previous exact image pins are in the rollout receipt.