coulomb/net-kingdom
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NET-WP-0019: implement T05 (OIDC claims helper + integration in script/console) and T06 (add dry-run to runbook_payloads for web-ui exposure; cross-link update in 0018 T07). Update workplan notes.

Browse Source
This commit is contained in:
Bernd Worsch
2026-06-03 07:10:56 +02:00
parent f56bca5b5d
commit 92bf7d1d1c
4 changed files with 68 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sso-mfa/k8s/lldap/dry-run-nonroot-user.sh
View File

@@ -175,6 +175,17 @@ bash ./check-user-mfa-state.sh platform-root 2>&1 | tail -5 || true
cd ../keycape || true
bash ./verify-openbao-client.sh 2>&1 | tail -3 || true
echo ""
echo "OIDC claims verification for dry-run (T05 non-secret helper)..."
python3 -c '
import sys, os
# from lldap dir, tools is ../../../tools
sys.path.insert(0, os.path.abspath("../../../tools/security-bootstrap-console"))
from security_bootstrap_console import print_dry_run_oidc_claims_verification
print_dry_run_oidc_claims_verification("'"$USERNAME"'", ["net-kingdom-users"])
' 2>&1 | cat || echo "(claims helper not available, using static example from guide)"
# 4. Lock + Offboard (GraphQL)
if $DO_LOCK_OFFBOARD; then
echo ""