Batch 257 tail: refused search base pages, supersession follows a retired-hash lineage, lock-notice follow-ups (BACKLOG #3010 #3170 #3120 #3028)

changelog.d/3010.security.md

@@ -1,17 +1,30 @@
-- **An LDAP search that does not end with success is an outage, never "no such account".** Each
-  search the engine sends refuses any result code but success, with or without entries. That
-  includes busy, unavailable, unwillingToPerform and adminLimitExceeded. It includes a time or size
-  limit, and noSuchObject on a missing search base. Before, such a search read as no entries. The
-  session reconciler would then have struck a present account toward revocation. A busy nested
-  group search read as fewer groups. The reconciler now reads these as unavailable, which never
-  revokes. A sign-in writes `auth.login_error` naming the code, and `check-privileges` names the
-  code for the bind-account read. These refusals name the operation and the code, never the
-  directory's diagnostic message. Other directory errors keep the text they had.
+- **An LDAP search that does not end with success is never "no such account".** Each search the
+  engine sends refuses any result code but success, with or without entries. That includes busy,
+  unavailable, unwillingToPerform and adminLimitExceeded. It includes a time or size limit, and
+  noSuchObject on a missing search base. Before, such a search read as no entries. The session
+  reconciler would then have struck a present account toward revocation. A busy nested group
+  search read as fewer groups. A sign-in now writes `auth.login_error` naming the code, and
+  `check-privileges` names the code for the bind-account read. These refusals name the operation
+  and the code, never the directory's diagnostic message. Other directory errors keep the text
+  they had.
+  **The session reconciler tells a configuration refusal from an outage.** noSuchObject,
+  invalidDNSyntax and insufficientAccessRights point at the configuration: a search base that was
+  deleted or moved, or that the service account may not read. Such a refusal leaves that account
+  unjudged and never revokes it. Every pass with one logs an ERROR naming the code, audits
+  `auth.ad_reconcile_misconfigured`, and raises `ad_reconcile_aborted` with reason
+  `directory_misconfigured` under the source `directory-reconciler-misconfigured`. A pass where
+  every lookup is refused, faulted or fails, at least one refused and none referred, aborts as
+  `directory_misconfigured`. Before, a deleted search base read as "not found" for every account,
+  which tripped the mass-revoke breaker on a large enough estate. Nothing resolves the new alert
+  automatically; an operator does. Any other code is an outage, which never revokes and pages
+  nobody. A second-factor step-up or a passkey assertion, which probes the directory before it
+  grants, refuses a refused account with outcome `misconfigured`. The password step-up and the
+  federated step-up refuse it as `directory_unavailable`, as they do any directory error.
   **Not covered:** ldap3 fetches a ranged `memberOf` with follow-up searches of its own, and those
   are not refused.
   **The cost:** a code that recurs on every pass, such as a deleted search base, stops revocation
-  and the role re-diff for as long as it lasts. It warns once per process for each operation and
-  code, and latches no alert.
+  and the role re-diff for as long as it lasts. A configuration code alerts; any other code warns
+  once per process for each operation and code, and latches no alert.
   **The nested group search is paged**, at 500 entries per page. So an account in more groups than
   a directory's unpaged cap no longer fails sign-in with sizeLimitExceeded. AD's cap, MaxPageSize,
   is 1000 by default. A page that does not end with success refuses the whole search. So does a
@@ -34,7 +47,7 @@
   **A bind response carrying a referral is a referral.** ldap3 cannot decode one. The boundary
   refuses it as a referral, naming no host. A sign-in writes `auth.login_error`, and the session
   reconciler reads it as referred and raises the `ad_reconcile_aborted` alert with reason
-  `directory_referral`, as on any referral. That alert's text points at the two search bases, not
-  at `[auth].ad_bind_dn`.
+  `directory_referral`, as on any referral. That alert's text names the two search bases and
+  `[auth].ad_bind_dn`, any of which may name another domain of the forest.
   Before, a sign-in that met one failed with an unhandled error, and the reconciler read it as a
   probe fault. (vault `BACKLOG #3010`)

changelog.d/3028.security.md

@@ -0,0 +1,12 @@
+- **A sign-in now ends the session its presented token became, when an elevation finished first.**
+  A console sign-in ends the session its browser presented. An elevation in another tab that
+  finished during the sign-in used to leave that token naming no session, so the session lived on
+  under its new token. Each rotation now records which token hash replaced the old one, in its own
+  store transaction, in a new `session_lineage` table on SQLite, Postgres and SQL Server. The
+  supersession follows those links to the live session and ends it, in the same transaction as the
+  revoke, for `[auth].oidc_flow_ttl_seconds` plus 120 seconds after each rotation; the session reaper
+  deletes older links. A retired token still authenticates nothing: no session read consults the
+  links. `docs/SECURITY.md` states the bound that remains, and ADR 0210 records the design.
+  On the server backends the schema change moves the ADR 0064 schema hash: under their default
+  `[store].schema_management`, `external`, the engine refuses to open until `provision-schema` has
+  run; under `auto` the next open runs the DDL.

changelog.d/3120.security.md

@@ -0,0 +1,21 @@
+- **A lock notice the relay's full queue drops no longer holds the next one back.** The security
+  notifier now says whether it queued a notice, and the `auth.lock_notice` row records
+  `mailed: false` for one it dropped, so the next lock of the kind mails again rather than staying
+  quiet for 24 hours. The same holds at shutdown: a lock notice that reaches the notifier once it
+  has begun to close, which a cut shutdown drain allows, is refused and recorded `mailed: false`
+  rather than reported queued for a mail that is never sent. The relay also records such a drop,
+  with the new undelivered-notice reason `closing`. A send that fails later, on the
+  relay's own task, still leaves `mailed: true`; `docs/SECURITY.md` states that residual.
+  **The lock notice's throttle read has an index.** A new `ix_audit_actor` index on
+  `audit_log(actor, action, id)`, on SQLite, Postgres and SQL Server, lets the read find one
+  account's rows instead of walking every recent notice row of every account. On Postgres it keys
+  the first 200 characters of the actor, since a whole overlong value would fail the audit write.
+  A companion `ix_audit_actor_id` index on `audit_log(actor, id)`, keyed the same way, keeps the
+  reads filtered by actor without an action equality (`GET /audit?actor=`, its export pages,
+  `/me/security-events`)
+  from sorting all of an actor's rows to return the newest few.
+  On the server backends the schema change moves the ADR 0064 schema hash: under their default
+  `[store].schema_management`, `external`, the engine refuses to open until `provision-schema` has
+  run; under `auto` the next open runs the DDL.
+  **Declined, with residuals in `docs/SECURITY.md`:** two mails across engine shards serving their
+  own API ports, the timing of the content-free failure lines, and a cap on pending notice tasks.

changelog.d/3170.security.md

@@ -1,11 +1,12 @@
-- **The session reconciler counts a referral over the lookups it sent, and strikes an id-less row
-  on every pass.** A directory row with no `objectGUID` is judged without a lookup, so no referral
-  can answer it. The referral's `auth.ad_reconcile_referred` audit row now carries the `asked`
-  field in place of `probed`, and that row, the referral's latched message and its
-  `ad_reconcile_aborted` alert count only the lookups the pass sent. The breaker's own alert still
-  counts every account it judged. Such a row is also struck now on a pass that is a directory
-  outage or aborted on referrals or probe faults, as on any other pass. Such a pass still revokes
-  nothing. Only a
-  pass that is not aborted can, once the row's strikes reach the threshold and the row is in that
-  pass's probe budget, so while every pass aborts its sessions last to their own expiry. Its revocation still counts toward the mass-revoke breaker, as before.
-  (`vault BACKLOG #3170`)
+- **The session reconciler counts a referral or a probe fault over the lookups it sent, and strikes
+  an id-less row on every pass.** A directory row with no `objectGUID` is judged without a lookup,
+  so no referral or fault can answer it. The `auth.ad_reconcile_referred` and
+  `auth.ad_reconcile_faulted` audit rows now carry the `asked` field in place of `probed`. Each
+  row, its latched message and its `ad_reconcile_aborted` alert count only the lookups the pass
+  sent. The breaker's alert still counts every account the pass judged, its denominator.
+  An id-less row is now struck on every pass, as on a pass that judged the directory's answers.
+  That includes a directory outage, and a pass aborted because every lookup was referred, faulted
+  or failed. No aborted pass revokes the row. Only a pass that is not aborted can, once the row's
+  strikes reach the threshold and the row is in that pass's probe budget. So while every pass
+  aborts, its sessions last to their own expiry. Its revocation still counts toward the
+  mass-revoke breaker, as before. (`vault BACKLOG #3170`)