stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
536f6249a62721494f9735dafa8b9e53db7754ea
git.stella-ops.org/docs/security/dpop-mtls-rollout.md
master 536f6249a6
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case 
- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.
2025-11-08 20:53:45 +02:00

2.6 KiB
Raw Blame History

Authority DPoP + mTLS Rollout Plan (Sprint 100)

Last updated: 2025-11-07

Objectives

  1. Enforce DPoP sender constraints (AUTH-DPOP-11-001).
  2. Bind high-assurance tenants to mTLS tokens (AUTH-MTLS-11-002).
  3. Provide telemetry + runbooks so plugins (SEC2/SEC3/SEC5) can validate enforcement without regressions.

Phase 1 · Config & Telemetry (ETA 2025-11-08)

  • Extend authority.yaml with security.senderConstraints.dpop section (nonce store, allowed algorithms, replay window).
  • Wire structured logs (authority.dpop.request) containing tenant, client, cnf thumbprint, nonce status.
  • Add DPoPNonceStore abstraction + Redis implementation for multi-node deployments.
  • Update integration tests: AuthorityTokenTests.DPoPNonceRequired, AuthorityTokenTests.DPoPMustMatchCnF.

Phase 2 · Enforcement & Fallback (ETA 2025-11-10)

  • Reject /token requests lacking DPoP proof when tenant policy requires it.
  • Persist cnf.jkt and expose through /introspect so downstream services validate sender.
  • Add emergency bypass flag (security.senderConstraints.dpop.allowTemporaryBypass) for sealed recap drills; default disabled.

Phase 3 · mTLS Binding (ETA 2025-11-10)

  • Capture client cert thumbprint on /token (mutual TLS) and store in authority_tokens.senderCertificate.
  • Validate cert hash on /introspect and /fresh-auth.
  • Document bootstrap/rotation in docs/11_AUTHORITY.md + docs/security/dpop-mtls-rollout.md (this file).

Verification Matrix

Scenario Test/Command Expected
DPoP required w/out proof dotnet test Authority.Tests --filter DPoPRequiresProofTest 400 with use_dpop_nonce header.
Nonce replay Replay previous proof within window 401 + audit log entry.
mTLS mismatch Reuse token with different cert 401 + senderCertificateMismatch metric increment.

Telemetry & Alerting

  • Metrics: authority_dpop_nonce_miss_total, authority_mtls_mismatch_total (emitted with reason tags for context-missing, missing-certificate, and thumbprint-mismatch cases).
  • Logs: authority.security.senderConstraint (structured).
  • Alerts: Page DevOps when nonce miss > 5% or mTLS mismatches > 0 over 10 min.

Dependencies

  • Authority Core & Security Guild owners.
  • DevOps to provide sealed-mode CI coverage (DEVOPS-AIRGAP-57-002).
  • Plugin Standard Guild to consume new telemetry once rolled out.

Communication

  • Daily async update in #guild-authority thread referencing this plan.
  • Link this document from docs/implplan/SPRINT_100_identity_signing.md notes once Phase 1 merges.