tegwick
c460e2b0df
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 629164@bnt-lap001 Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720
87 lines
4.8 KiB
Markdown
87 lines
4.8 KiB
Markdown
# Attended MFA acceptance run: U05–U08, first real user tegwick
|
||
|
||
Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message
|
||
ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub
|
||
decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md).
|
||
|
||
## What already exists
|
||
|
||
- **Enrollment surface.** privacyIDEA self-service runs at
|
||
`https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`).
|
||
Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets
|
||
any user in that realm enroll, delete or disable their own TOTP token. Tokens
|
||
are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows
|
||
`tegwick@coulomb`.
|
||
- **Portal guidance.** `/security` explains setup, cancellation, a rejected
|
||
code and a lost authenticator. It also covers the no-factor-yet case. Until
|
||
`USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and
|
||
points to the tenant administrator.
|
||
- **Recovery and replacement.** P04 recovery and P06 policy are deployed and
|
||
were verified with installed-provider fixtures
|
||
([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)).
|
||
|
||
What is missing is a real person going through it, plus the portal handoff
|
||
link.
|
||
|
||
## Does tegwick need to join the coulomb-social pilot?
|
||
|
||
Not to enroll. Enrollment is per realm, not per client. Joining is needed only
|
||
to observe U05 and U07 on the pilot client, where MFA is optional. On
|
||
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
|
||
(U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick
|
||
runs on coulomb-social, so all four journeys run on one client. There is no
|
||
pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so
|
||
"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason
|
||
needs (MASON-WP-0005-T05).
|
||
|
||
## Before the run (operator)
|
||
|
||
1. Done. `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social`
|
||
is live. Its apply home is `rapp-user-engine` `manifests/runtime.yaml`; the
|
||
net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` is only migration input.
|
||
Verified on 2026-10-10: the public `https://users.coulomb.social/security`
|
||
shows *Manage authenticator app* pointing to pink-account.
|
||
2. Confirm tegwick has no active token: privacyIDEA admin token list for
|
||
`tegwick@coulomb`, token count only.
|
||
|
||
## Attended steps (tegwick at the keyboard, operator observing)
|
||
|
||
| Step | Journey | Where | Expected | Record |
|
||
| --- | --- | --- | --- | --- |
|
||
| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome |
|
||
| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
|
||
| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
|
||
| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
|
||
| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
|
||
| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |
|
||
|
||
Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
|
||
has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.
|
||
|
||
## Evidence rules
|
||
|
||
Record times, outcomes, client ids, token serial suffixes and recovery record
|
||
ids in `docs/evidence/<date>-mfa-attended-u05-u08.md`. **Never** record a seed,
|
||
a QR code or image, an OTP value, a password or a session cookie, and do not
|
||
take screenshots of the enrollment page. No step is inferred from a redirect,
|
||
a return parameter or an assurance claim.
|
||
|
||
## After acceptance
|
||
|
||
Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP
|
||
user in realm `coulomb` and every KeyCape client, because enrollment does not
|
||
depend on the client. MFA stays optional except where KeyCape already asks for
|
||
it (`openbao-admin`).
|
||
|
||
Still deferred:
|
||
|
||
- admin-required MFA, which would be an issuer-side client policy applied
|
||
through P06 and needs the founder's go;
|
||
- showing authoritative enrollment status in the portal;
|
||
- a link from KeyCape's OTP prompt to `/security` for users who have no factor
|
||
yet. That page belongs to key-cape, and today it is the dead end tegwick hit.
|
||
|
||
## Hand-off
|
||
|
||
USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the
|
||
recorded evidence.
|