31 lines
2.3 KiB
Markdown
31 lines
2.3 KiB
Markdown
# ADR-0049: Named operator keys and bounded Console access
|
|
|
|
Status: accepted for RC-01, 2026-09-08. Online managed identities extend this deployment-owned
|
|
provider under ADR-0052; its distinct ownership and recovery contract supersede only the online
|
|
identity-administration limitation below. The deployment registry contract remains unchanged.
|
|
|
|
Support a small deployment-owned registry of named human credentials as the first attributable
|
|
viewer/operator/admin authentication provider. Each immutable deployment record identifies a
|
|
credential, subject, role, SHA-256 digest and required UTC-aware expiry. Generate keys with 256 bits
|
|
of randomness and the distinct `mfop_` namespace. Validate the complete bounded registry at startup;
|
|
reject duplicate JSON fields, credential IDs, digests, conflicting roles and reserved subjects.
|
|
Rotation may temporarily retain two records for the same subject and role. Removing a record takes
|
|
effect when the API is recreated with the replacement configuration. This is a deployment operation,
|
|
not an online secret-management API. There is no new database state or migration.
|
|
|
|
Keep the legacy administrator header and bootstrap key compatible. Named credentials use that header
|
|
but never fall back to bootstrap privileges, including after expiry/revocation. Machine keys and
|
|
single-use enrollment tokens cannot authenticate as humans. The existing role dependencies remain
|
|
the authorization authority, and audit writers receive the authenticated subject and correlation ID.
|
|
An installation may disable bootstrap access once it has an unexpired named administrator.
|
|
|
|
The Console verifies identity before loading protected data, exposes subject, role and key expiry,
|
|
and clears its memory-only key on manual lock, reload, credential refusal or after at most fifteen
|
|
minutes. This local lock deadline is distinct from server-enforced key expiry. Protected responses
|
|
carry `Cache-Control: no-store`; requests do not use cookies. Stale responses cannot restore data or
|
|
invalidate a newly unlocked session. A dependency outage and a forbidden operation are not logout.
|
|
|
|
OIDC/Authentik, server-issued browser sessions, online identity administration and an audited
|
|
write-only deployment-secret lifecycle remain explicit RC limitations. This provider establishes
|
|
real least privilege and attribution without claiming enterprise IAM or SSO completion.
|