tegwick
2edb4f1e43
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 445231@bnt-lap001 Assistant-Session: 024a807e-0cc5-4f2c-bc8a-b83322d1395d
37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# MFA pilot: coulomb-social, optional, NetKingdom-held — 2026-10-09
|
|
|
|
Founder decision (Bernd, 2026-10-09). It answers the pilot and policy part of
|
|
NK-WP-0042-T02 (hub thread 892fd489). It does not resolve decision cef97ccd: user-perspective acceptance of the MFA journey still
|
|
needs the attended run (USER-WP-0027-T04, USER-WP-0028-T03).
|
|
|
|
## Decision
|
|
|
|
1. **Pilot workload:** coulomb-social.
|
|
2. **MFA code stays in NetKingdom infrastructure.** Enrollment, verification,
|
|
replacement, recovery, and the policy that requires MFA live with the issuer
|
|
(KeyCape / Keycloak, the provider factor) and user-engine (`/security`, the
|
|
provider-management handoff, P04 recovery, P06 policy). coulomb-social does
|
|
not gain factor, enrollment, recovery, or MFA policy code. It stays a plain
|
|
OIDC relying party.
|
|
3. **MFA is optional for coulomb-social users.** Password-only sign-in stays
|
|
valid (U05). Users may enroll voluntarily through the NetKingdom path (U06).
|
|
Once a user has enrolled, the issuer enforces their factor (U07).
|
|
4. **Admin-required MFA is deferred, not urgent.** When a coulomb-social admin
|
|
later wants MFA required for users, it will be an issuer-side client policy
|
|
applied through the NetKingdom admin surface (P06 preview/apply/rollback). It
|
|
will not be a coulomb-social code path. Turning it on is a separate change that
|
|
needs the founder's go.
|
|
|
|
## Consequences
|
|
|
|
- No `acr_values=aal2` switch-on for coulomb-social now. Under optional MFA,
|
|
coulomb-social requests no assurance level.
|
|
- coulomb-social already contains a dormant relying-party hook
|
|
(`?assurance=aal2` → `acr_values`, plus a local acr check in
|
|
`apps/identity/views.py`). Nothing links to it. Whether to keep it dormant or
|
|
remove it is coulomb-social's call. The issuer-side policy route in (4) does
|
|
not need it.
|
|
- coulomb-social may link users to the NetKingdom `/security` page for
|
|
optional enrollment and recovery help. That link is navigation, not MFA logic.
|
|
- This narrows the SCOPE line "action step-up — consuming apps": for this
|
|
pilot, step-up sits with KeyCape client policy.
|