2.3 KiB
ADR-0049: Named operator keys and bounded Console access
Status: accepted for RC-01, 2026-09-08. Online managed identities extend this deployment-owned provider under ADR-0052; its distinct ownership and recovery contract supersede only the online identity-administration limitation below. The deployment registry contract remains unchanged.
Support a small deployment-owned registry of named human credentials as the first attributable
viewer/operator/admin authentication provider. Each immutable deployment record identifies a
credential, subject, role, SHA-256 digest and required UTC-aware expiry. Generate keys with 256 bits
of randomness and the distinct mfop_ namespace. Validate the complete bounded registry at startup;
reject duplicate JSON fields, credential IDs, digests, conflicting roles and reserved subjects.
Rotation may temporarily retain two records for the same subject and role. Removing a record takes
effect when the API is recreated with the replacement configuration. This is a deployment operation,
not an online secret-management API. There is no new database state or migration.
Keep the legacy administrator header and bootstrap key compatible. Named credentials use that header but never fall back to bootstrap privileges, including after expiry/revocation. Machine keys and single-use enrollment tokens cannot authenticate as humans. The existing role dependencies remain the authorization authority, and audit writers receive the authenticated subject and correlation ID. An installation may disable bootstrap access once it has an unexpired named administrator.
The Console verifies identity before loading protected data, exposes subject, role and key expiry,
and clears its memory-only key on manual lock, reload, credential refusal or after at most fifteen
minutes. This local lock deadline is distinct from server-enforced key expiry. Protected responses
carry Cache-Control: no-store; requests do not use cookies. Stale responses cannot restore data or
invalidate a newly unlocked session. A dependency outage and a forbidden operation are not logout.
OIDC/Authentik, server-issued browser sessions, online identity administration and an audited write-only deployment-secret lifecycle remain explicit RC limitations. This provider establishes real least privilege and attribution without claiming enterprise IAM or SSO completion.