coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/docs/evidence/2026-09-13-p06-authentication-policy.md
tegwick 3bd1827a7f
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
Build and Publish Container Image / build-and-push (push) Successful in 51s
Details
Account journey acceptance / journeys (push) Successful in 7s
Details
Implement scoped P06 authentication policy and guarded optional onboarding 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 00:00:07 +02:00

1.9 KiB
Raw Blame History

P06 authentication policy acceptance

Scoped to vergabe-demo-company and user-engine-portal. The issuer owns persistent policy, revision-bound previews, acknowledged apply, durable receipts and reviewed rollback. Explicit application AAL2 remains authoritative. Portal administration requires MFA; policy and factor recovery require recent MFA.

Optional means password-only until a confirmed active authenticator exists. Provider lookup failures deny login. Pending setup can be cancelled; active factor replacement requires audited recovery, including from old AAL1 sessions.

Verification

  • Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
  • Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
  • Issuer policy/runtime regression tests passed; two policy rollout and one provider guard deployment tests passed.
  • Installed privacyIDEA fixture provider-p06-browser-46713f7e: native adapter confirms no-factor/pending login, activation, old-session MFA, explicit AAL2 and successful OTP sign-in. Five browser checks pass: correct identity, pending possession proof, cancellation, confirmed activation and denied replacement with a visible recovery route.
  • Provider image: ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473.

Fixture repairs submit OTP to /authorize/callback, wait for asynchronous TOTP selection, and wait for loaded pending state and an enabled Delete button. The fixture uses disposable databases and synthetic identities, with no production account changes. Reproduce using key-cape scripts/provider_browser_acceptance.py and user-engine scripts/browser_journeys.py.

Release

Pending CI image publication and ordered live rollout. Do not infer deployment or complete platform journey acceptance from these test results.