tegwick
8d525d959e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
79 lines
4.6 KiB
Markdown
79 lines
4.6 KiB
Markdown
# P06 authentication policy acceptance
|
||
|
||
Scoped to `vergabe-demo-company` and `user-engine-portal`. The issuer owns
|
||
persistent policy, revision-bound previews, acknowledged apply, durable receipts
|
||
and reviewed rollback. Explicit application AAL2 remains authoritative. Portal
|
||
administration requires MFA; policy and factor recovery require recent MFA.
|
||
|
||
Optional means password-only until a confirmed active authenticator exists.
|
||
Provider lookup failures deny login. Pending setup can be cancelled; active
|
||
factor replacement requires audited recovery, including from old AAL1 sessions.
|
||
|
||
## Verification
|
||
|
||
- Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
|
||
- Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
|
||
- Final platform completeness gate: 33 tests passed, zero skips, all P01–P08
|
||
marked implemented with no unresolved platform journeys. See the adjacent
|
||
P06 platform-complete JSON report.
|
||
- Issuer policy/runtime regression tests passed; two policy rollout and one
|
||
provider guard deployment tests passed.
|
||
- Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
|
||
confirms no-factor/pending login, activation, old-session MFA, explicit AAL2
|
||
and successful OTP sign-in. Five browser checks pass: correct identity,
|
||
pending possession proof, cancellation, confirmed activation and denied
|
||
replacement with a visible recovery route.
|
||
- Provider image: `ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473`.
|
||
|
||
Fixture repairs submit OTP to `/authorize/callback`, wait for asynchronous TOTP
|
||
selection, and wait for loaded pending state and an enabled Delete button.
|
||
The fixture uses disposable databases and synthetic identities, with no
|
||
production account changes. Reproduce using key-cape
|
||
`scripts/provider_browser_acceptance.py` and user-engine
|
||
`scripts/browser_journeys.py`.
|
||
|
||
## Release
|
||
|
||
Completed 2026-09-14 Europe/Berlin (2026-09-13 UTC):
|
||
|
||
- KeyCape source `e0b3c25`; CI acceptance run 64 and image run 65 passed.
|
||
- Portal source `3bd1827`; image run 178 and journey run 179 passed. Routing-only
|
||
smoke run 177 was cancelled; it is not claimed as passed.
|
||
- NetKingdom policy/guard tooling: `a549617`.
|
||
- Portal image: `forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c`.
|
||
- Issuer image: `forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5`.
|
||
|
||
Portal guards rolled out first. Provider guard
|
||
`keycape-onboarding-9465e5e0b98f7986` then rolled out to privacyIDEA and recovery.
|
||
Provider policy readback confirms TOTP enrollment, pending-only deletion and
|
||
active-factor changes through recovery; existing tokens were unchanged.
|
||
Only the two reviewed client registrations were migrated with UID/resource-version
|
||
CAS and unrelated Secret bytes preserved. Issuer replacement then activated
|
||
persistent policy at `/var/lib/keycape-policy/policy.json` on the dedicated PVC.
|
||
|
||
Read-only Job `p06-policy-readback-1c0eba21` verified both effective policies are
|
||
`optional_after_enrollment`, revision 0, no administrative changes yet. The Job
|
||
was removed. Portal health/readiness and issuer readiness return 200; both policy
|
||
surfaces reject anonymous access with 403. The migration inspector reports no
|
||
remaining change. Receipts are in the adjacent P06 rollout JSON.
|
||
|
||
Positive policy changes/replay/rollback are tested in isolated stores and portal
|
||
fixtures. No production account or real administrator policy override was used
|
||
as a test. Actual invited-person and application sign-in acceptance remains in
|
||
USER-WP-0028 / KEY-WP-0034 / VERGABE-WP-0019.
|
||
|
||
## Operating policy and rollback
|
||
|
||
Open Platform administration → Authentication policy and verify with fresh MFA.
|
||
Select a reviewed client, policy and change reference; preview the impact and
|
||
acknowledge it before applying. Cancel leaves policy unchanged. A stale review
|
||
requires a new preview; an uncertain response should be checked in current state
|
||
and history. Rollback is a new reviewed change to that client's previous policy.
|
||
|
||
Preserve the policy PVC and receipts across issuer replacement; do not delete
|
||
it during rollback. It uses this cluster's local-path storage, not multi-node HA.
|
||
Before reverting to a pre-P06 portal or issuer, restore mandatory MFA for both
|
||
clients in runtime policy and the baseline client registrations, verify it, then
|
||
restore the previous image pins. Keep the provider active-factor guard and
|
||
recovery service. Reverting the portal guards while optional login remains active
|
||
would weaken administration. Previous exact image pins are in the rollout receipt.
|