Authority Threat Model (STRIDE)

Prepared by: Security Guild — 2025-10-12. Scope: Authority host, Standard plug-in, CLI, bootstrap workflow, and offline revocation distribution.

Related: For implementation details, see Authority architecture. Sender-constraint binding (DPoP/mTLS) rollout is tracked in DPoP & mTLS rollout; the offline revocation bundle format is documented in Revocation bundle. Canonical scopes (StellaOpsScopes) are catalogued in Authority scopes.

1. Scope & Method

• Methodology: STRIDE applied to primary Authority surfaces (token issuance, bootstrap, revocation, operator tooling, plug-in extensibility).
• Assets in scope: identity credentials, OAuth tokens (access/refresh), bootstrap invites, revocation manifests, signing keys, audit telemetry.
• In scope (first-party identity providers): the Standard plug-in plus the LDAP, OIDC, and SAML federation plug-ins (StellaOps.Authority.Plugin.{Standard,Ldap,Oidc,Saml}). All identity providers are loaded as Authority plug-ins behind the same OpenIddict token-issuance surface; their credential paths inherit the controls in this model.
• Out of scope: external relying-party applications that consume issued tokens (they validate via published JWKS / introspection); cross-tenant federation policy is tracked separately under the platform federation scopes (platform:federation:*).

2. Assets & Entry Points

3. Trust Boundaries

4. Data Flow Diagrams

4.1 Runtime token issuance

flowchart LR
    subgraph Client Tier
        CLI[StellaOps CLI]
        UI[UI / Automation]
    end
    subgraph Perimeter
        RP[Reverse Proxy / WAF]
    end
    subgraph Authority
        AUTH[Authority Host]
        PLGIN[Standard Plug-in]
        STORE[(PostgreSQL Credential Store)]
    end
    CLI -->|OAuth password / client creds| RP --> AUTH
    UI -->|OAuth flows| RP
    AUTH -->|PasswordHashOptions + Secrets| PLGIN
    AUTH -->|Verify / Persist hashes| STORE
    STORE -->|Rehash needed| AUTH
    AUTH -->|Access / refresh token| RP --> Client Tier

4.2 Bootstrap & revocation

flowchart LR
    subgraph Operator
        OPS[Operator Workstation]
    end
    subgraph Authority
        AUTH[Authority Host]
        STORE[(PostgreSQL)]
    end
    subgraph Distribution
        OFFKIT[Offline Kit Bundle]
        AGENT[Authorized Agent / Concelier]
    end
    OPS -->|POST /internal/users + X-StellaOps-Bootstrap-Key| AUTH
    AUTH -->|One-time invite + Argon2id hash| STORE
    AUTH -->|GET /internal/revocations/export (signed bundle + detached JWS)| OFFKIT
    OFFKIT -->|Base64 JSON + JWS signature + sha256 digest| AGENT
    AGENT -->|Revocation ACK / telemetry| AUTH

5. STRIDE Analysis

Risk scoring uses qualitative scale (Low/Med/High) for likelihood × impact; mitigation priority follows High > Med > Low.

6. Follow-up Backlog Hooks

Update src/__Libraries/StellaOps.Cryptography/TASKS.md (Security Guild board) with the above backlog entries to satisfy SEC5.A exit criteria.

6.1 Plugin telemetry status (SEC5.PLG — 2025-11-09)

• Standard plug-in password verification now emits authority.plugin.standard.password_verification with caller correlation IDs, client metadata, tenant IDs, and full network context sourced from AuthorityCredentialAuditContext. Events classify outcomes via the extended AuthEventOutcome set (LockedOut, RequiresFreshAuth, RequiresMfa) so SOC tooling can distinguish lockouts from MFA prompts.
• Audit properties were standardised: plugin.failed_attempts, plugin.lockout_until, plugin.retry_after_seconds, plugin.rehashed, and plugin.failure_code are present on both the plug-in event and the host-level /token record. plugin.retry_after_seconds is derived deterministically from the retry window, ensuring consistent rate-limit responses for air-gapped tenants.
• Bootstrap mitigations were documented in docs/dev/31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md: Argon2id hashing, enforced password policies, default RequirePasswordReset, and registrar warnings when an operator weakens the baseline policy. These measures close the SEC5.PLG action item and provide auditors with evidence hooks for Offline Kit reviews.