#216: hard AUTH_LOCAL_ENABLED switch over every local credential flow #284

fable-5 · 2026-07-31T13:09:54+02:00

fable-5 commented

2026-07-31 13:09:54 +02:00

Deploy-level realization of auth.local.enabled: false answers 404 on login, signup, verification, resend, password forgot/reset/change - enforced centrally via the @LocalCredentialFlow marker; an enumeration fence fails when an auth route is neither marked nor allowlisted. Deploy-level so a compromised Site Admin cannot flip it back (R-02 closed). Stated + tested: sessions/logout keep working, PAT/feed-token issuance stays available to IdP-authenticated users. Bootstrap: setup before flipping; boot warning when no sign-in path remains. Login page hides the local form. Hardening guide: 1.3 row went live in 1.2 incl. verification probe. Stacked on #215. Refs #216

fable-5 added 3 commits 2026-07-31 13:09:54 +02:00

#214 : OIDC Authorization Code with PKCE, Keycloak as reference IdP

CI / Lint, typecheck, test (pull_request) Failing after 14s

Details

CI / Import/export fidelity gate (pull_request) Has been skipped

Details

CI / Build container images (pull_request) Has been skipped

Details

CI / Auth e2e pack (pull_request) Has been skipped

Details

5796b7a5dd

External authentication (ADR 0021) built on jose (#188's vetted library)
plus fetch — no new dependency enters the supply chain for a security
base function. Discovery-configured; ID tokens validate against the
IdP's JWKS under an explicit RS256/ES256 allowlist with issuer,
audience, expiry and nonce binding. State, nonce and the PKCE verifier
travel in a signed HttpOnly Lax cookie keyed by a dedicated HKDF
purpose (oidc-state, ADR 0020).

Deploy-level configuration (OIDC_ISSUER/CLIENT_ID/CLIENT_SECRET/SCOPES/
PROVIDER_LABEL): who authenticates users is a platform decision. The
login page discovers the provider via GET /auth/methods and renders the
SSO button (i18n de+en).

Identities use the existing slot (provider oidc:<issuer>, subject from
the token). First login creates the account just-in-time — ACTIVE and
mail-verified only when the IdP asserts a verified address. An existing
local account is NEVER adopted silently by e-mail (account-takeover
path): login refuses with oidc_link_required and the owner links
explicitly via GET /auth/oidc/link (audited auth.identity_linked,
catalogue v1.3). Sessions come from the one existing session service.

Tests run the full flow against a protocol-faithful fake IdP: PKCE
verifier at the token endpoint, JIT creation incl. personal pond,
invalid state/nonce/signature/issuer/audience/expiry each rejected, the
linking refusal and the explicit link flow. Verified end-to-end against
a real Keycloak 26.0 (repeatable procedure documented in security.md
§External authentication).

Refs #214.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

#215 : trusted reverse-proxy header / mTLS client-certificate path

CI / Lint, typecheck, test (pull_request) Successful in 6m44s

Details

CI / Build container images (pull_request) Successful in 4m42s

Details

CI / Auth e2e pack (pull_request) Successful in 9m15s

Details

CI / Import/export fidelity gate (pull_request) Successful in 59s

Details

CD / Deploy to Test (push) Blocked by required conditions

Details

CD / Smoke tests against Test (push) Blocked by required conditions

Details

CD / Promote to Int (push) Blocked by required conditions

Details

CI / Auth e2e pack (push) Blocked by required conditions

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Build container images (push) Blocked by required conditions

Details

CD / Build and push images (push) Has been cancelled

Details

CI / Lint, typecheck, test (push) Has been cancelled

Details

4c7f001cab

For perimeters that authenticate before the application (ADR 0021 §4).
Off unless BOTH AUTH_PROXY_HEADER and AUTH_PROXY_TRUSTED_PEERS are set —
nothing about the header is guessed. The peer check runs against the TCP
peer address only (a forwarded header is attacker-influenced): a request
carrying the header from any other peer is rejected outright and audited
as auth.proxy_rejected (catalogue v1.4) — that is a spoof attempt, not a
misconfiguration — even when a valid session cookie rides along. From a
trusted peer the header IS the identity; a session cookie never
escalates beyond it; with the feature off the header is inert.

Mapping is explicit (AUTH_PROXY_MAP: username or e-mail); deliberately
no just-in-time creation — the header carries no verified address. The
mTLS variant (AUTH_PROXY_MODE=mtls-dn) maps the configured attribute
(default CN) out of the certificate subject DN the TLS terminator
forwards, under the same peer rules. Session-less proxy requests key the
read trail per user (user:<id>).

The trust boundary is stated in security.md (the section an assessor
reads closest), the VS-NfD security documentation and the hardening
guide's deploy table. Tests cover all four decisions: off = inert,
trusted peer authenticates (username and DN mapping), untrusted peer
rejected + audited, no escalation past a session cookie.

Refs #215.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

#216 : hard AUTH_LOCAL_ENABLED switch over every local credential flow

CI / Lint, typecheck, test (pull_request) Successful in 6m55s

Details

CI / Build container images (pull_request) Successful in 4m43s

Details

CI / Auth e2e pack (pull_request) Successful in 9m13s

Details

CI / Import/export fidelity gate (pull_request) Successful in 1m4s

Details

CD / Deploy to Test (push) Blocked by required conditions

Details

CD / Smoke tests against Test (push) Blocked by required conditions

Details

CD / Promote to Int (push) Blocked by required conditions

Details

CI / Auth e2e pack (push) Blocked by required conditions

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Build container images (push) Blocked by required conditions

Details

CI / Lint, typecheck, test (push) Has been cancelled

Details

CD / Build and push images (push) Has been cancelled

Details

13f0311d8e

The deploy-level realization of auth.local.enabled (ADR 0021): FALSE
answers 404 on every local credential flow — login, signup, e-mail
verification, resend, password forgot/reset/change — enforced centrally
in the auth guard via the @LocalCredentialFlow() marker before any
session or CSRF logic runs. Deploy-level on purpose: a compromised Site
Admin cannot reopen the local path, so the runtime-flip residual risk
from ADR 0021 does not materialize (R-02 closed in the risk list).

An enumeration fence fails when an auth route is neither marked nor on
the reviewed allowlist, so a new credential flow cannot ship unswitched.
Stated decisions, each tested: sessions/logout keep working for
externally authenticated users; PAT and feed-token issuance stays
available (API authorization under its own switches, not interactive
sign-in). Bootstrap: complete setup (or SETUP_ADMIN_* pre-seed) before
flipping; the api warns at boot when local auth is off with neither OIDC
nor proxy auth configured. GET /auth/methods reports local:false and the
login page hides the local form and credential links.

Hardening guide: the planned auth.local.enabled row moves from 1.3 into
the live deploy table with the bootstrap ordering, and the verification
checklist gains the login-404 probe.

Refs #216.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit 13f0311d8e into main

2026-07-31 13:35:55 +02:00

fable-5 referenced this pull request

2026-07-31 13:47:16 +02:00

[VS-NfD] Add a hard `auth.local.enabled = false` switch covering every local credential flow #216

Sign in to join this conversation.

No reviewers