stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
92bc4d3a0703a414969cdcbed3571a0fe382cda7
git.stella-ops.org/docs/security/dpop-mtls-rollout.md
master ae69b1a8a1 feat: Add documentation and task tracking for Sprints 508 to 514 in Ops & Offline 
- Created detailed markdown files for Sprints 508 (Ops Offline Kit), 509 (Samples), 510 (AirGap), 511 (Api), 512 (Bench), 513 (Provenance), and 514 (Sovereign Crypto Enablement) outlining tasks, dependencies, and owners.
- Introduced a comprehensive Reachability Evidence Delivery Guide to streamline the reachability signal process.
- Implemented unit tests for Advisory AI to block known injection patterns and redact secrets.
- Added AuthoritySenderConstraintHelper to manage sender constraints in OpenIddict transactions.
2025-11-08 23:18:28 +02:00

2.8 KiB
Raw Blame History

Authority DPoP + mTLS Rollout Plan (Sprint 100)

Last updated: 2025-11-07

Objectives

  1. Enforce DPoP sender constraints (AUTH-DPOP-11-001).
  2. Bind high-assurance tenants to mTLS tokens (AUTH-MTLS-11-002).
  3. Provide telemetry + runbooks so plugins (SEC2/SEC3/SEC5) can validate enforcement without regressions.

Phase 1 · Config & Telemetry (ETA 2025-11-08)

  • Extend authority.yaml with security.senderConstraints.dpop section (nonce store, allowed algorithms, replay window).
  • Wire structured logs (authority.dpop.request) containing tenant, client, cnf thumbprint, nonce status.
  • Add DPoPNonceStore abstraction + Redis implementation for multi-node deployments.
  • Update integration tests: AuthorityTokenTests.DPoPNonceRequired, AuthorityTokenTests.DPoPMustMatchCnF.

Phase 2 · Enforcement & Fallback (ETA 2025-11-10)

  • Reject /token requests lacking DPoP proof when tenant policy requires it.
  • Persist cnf.jkt and expose through /introspect so downstream services validate sender.
  • Add emergency bypass flag (security.senderConstraints.dpop.allowTemporaryBypass) for sealed recap drills; default disabled.
    • When enabled, Authority logs authority.dpop.proof.bypass, adds authority.dpop_result=bypass telemetry, and issues tokens without cnf so downstream services know sender constraints were relaxed. Reset immediately after the drill.

Phase 3 · mTLS Binding (ETA 2025-11-10)

  • Capture client cert thumbprint on /token (mutual TLS) and store in authority_tokens.senderCertificate.
  • Validate cert hash on /introspect and /fresh-auth.
  • Document bootstrap/rotation in docs/11_AUTHORITY.md + docs/security/dpop-mtls-rollout.md (this file).

Verification Matrix

Scenario Test/Command Expected
DPoP required w/out proof dotnet test Authority.Tests --filter DPoPRequiresProofTest 400 with use_dpop_nonce header.
Nonce replay Replay previous proof within window 401 + audit log entry.
mTLS mismatch Reuse token with different cert 401 + senderCertificateMismatch metric increment.

Telemetry & Alerting

  • Metrics: authority_dpop_nonce_miss_total, authority_mtls_mismatch_total (emitted with reason tags for context-missing, missing-certificate, and thumbprint-mismatch cases).
  • Logs: authority.security.senderConstraint (structured).
  • Alerts: Page DevOps when nonce miss > 5% or mTLS mismatches > 0 over 10 min.

Dependencies

  • Authority Core & Security Guild owners.
  • DevOps to provide sealed-mode CI coverage (DEVOPS-AIRGAP-57-002).
  • Plugin Standard Guild to consume new telemetry once rolled out.

Communication

  • Daily async update in #guild-authority thread referencing this plan.
  • Link this document from docs/implplan/SPRINT_100_identity_signing.md notes once Phase 1 merges.