cesnimda
36 lines
2.6 KiB
Markdown
36 lines
2.6 KiB
Markdown
# SEC-003 Microsoft tenant validation verification
|
|
|
|
Date: 2026-08-02
|
|
Status: `VERIFIED LOCALLY`; JT-001 remains open pending SEC-004.
|
|
|
|
## Implemented boundary
|
|
|
|
- `Auth:MicrosoftTenant` supports an exact tenant GUID, `organizations`, `consumers`, or explicit `common`; Production requires a value when Microsoft sign-in is enabled.
|
|
- Tokens require GUID-shaped `tid` and `oid`, exact `https://login.microsoftonline.com/{tid}/v2.0` issuer agreement, allowed tenant mode, configured audience, valid signature and lifetime.
|
|
- The validator returns normalized tenant/object IDs and treats email-like claims as metadata (`EmailVerified=false`). `Subject` temporarily remains the normalized `oid` only for legacy controller compatibility until SEC-004.
|
|
- The undocumented raw Microsoft bearer scheme and smart-selector branch were removed. Microsoft identity tokens enter only through the exchange/link validator.
|
|
- The application sign-in tenant is explicitly separate from `Microsoft:TenantId` used for Graph mailbox OAuth.
|
|
|
|
## Commands and results
|
|
|
|
| Command/check | Result |
|
|
|---|---|
|
|
| focused Microsoft validator + auth controller tests | Pass; 42/42 |
|
|
| full backend Release suite | Pass; 491/491 |
|
|
| normalized deploy-shell syntax | Pass |
|
|
| production Compose config with synthetic `organizations` mode | Pass |
|
|
| source search for raw Microsoft bearer registration/selector | Removed; exchange validator is the remaining sign-in trust path |
|
|
|
|
The focused validator suite covers Production missing configuration, invalid mode, common,
|
|
organizations, consumers, exact single tenant, personal-account rejection/acceptance, missing and
|
|
non-GUID `tid`/`oid`, issuer/tenant mismatch, wrong audience, wrong signature, expiry, and identical
|
|
`oid` values in two tenants.
|
|
|
|
## Remaining risk and gates
|
|
|
|
- **JT-001 remains High / High / likely defect.** `ApplicationUser` still lacks canonical tenant/object columns and controller lookups still contain legacy subject/email behavior. This package validates identity input but does not claim safe account ownership.
|
|
- No Microsoft provider was contacted. Browser/provider success, cancellation, wrong-tenant and consent behavior are unverified.
|
|
- Production must inventory legacy link counts/collisions and alternate credentials before enabling the stricter policy.
|
|
- SEC-004 must add canonical pair persistence, collision-safe lookup and the approved legacy recovery ceremony. Until then Microsoft sign-in should remain disabled in production.
|
|
- Rollback can restore the prior validator binaries, but must not be used to re-enable raw bearer trust in production. No database change exists in this package.
|