Authority DPoP + mTLS Rollout Plan (Sprint 100)

Last updated: 2025-11-07

Objectives

  1. Enforce DPoP sender constraints (AUTH-DPOP-11-001).
  2. Bind high-assurance tenants to mTLS tokens (AUTH-MTLS-11-002).
  3. Provide telemetry + runbooks so plugins (SEC2/SEC3/SEC5) can validate enforcement without regressions.

Phase 1 · Config & Telemetry (ETA 2025-11-08)

  • [x] Extend authority.yaml with security.senderConstraints.dpop section (nonce store, allowed algorithms, replay window).
  • [x] Wire structured logs (authority.dpop.request) containing tenant, client, cnf thumbprint, nonce status.
  • [x] Add DPoPNonceStore abstraction + Redis implementation for multi-node deployments.
  • [x] Update integration tests: AuthorityTokenTests.DPoPNonceRequired, AuthorityTokenTests.DPoPMustMatchCnF.

Phase 2 · Enforcement & Fallback (ETA 2025-11-10)

  • [x] Reject /token requests lacking DPoP proof when tenant policy requires it.
  • [x] Persist cnf.jkt and expose through /introspect so downstream services validate sender.
  • [x] Add emergency bypass flag (security.senderConstraints.dpop.allowTemporaryBypass) for sealed recap drills; default disabled.
    • When enabled, Authority logs authority.dpop.proof.bypass, adds authority.dpop_result=bypass telemetry, and issues tokens without cnf so downstream services know sender constraints were relaxed. Reset immediately after the drill.

Phase 3 · mTLS Binding (ETA 2025-11-10)

  • [x] Capture client cert thumbprint on /token (mutual TLS) and store in authority_tokens.senderCertificate.
  • [x] Validate cert hash on /introspect and /fresh-auth.
  • [ ] Document bootstrap/rotation in docs/11_AUTHORITY.md + docs/security/dpop-mtls-rollout.md (this file).

Verification Matrix

ScenarioTest/CommandExpected
DPoP required w/out proofdotnet test Authority.Tests --filter DPoPRequiresProofTest400 with use_dpop_nonce header.
Nonce replayReplay previous proof within window401 + audit log entry.
mTLS mismatchReuse token with different cert401 + senderCertificateMismatch metric increment.

Telemetry & Alerting

  • Metrics: authority_dpop_nonce_miss_total, authority_mtls_mismatch_total (emitted with reason tags for context-missing, missing-certificate, and thumbprint-mismatch cases).
  • Logs: authority.security.senderConstraint (structured).
  • Alerts: Page DevOps when nonce miss > 5% or mTLS mismatches > 0 over 10 min.

Dependencies

  • Authority Core & Security Guild owners.
  • DevOps to provide sealed-mode CI coverage (DEVOPS-AIRGAP-57-002).
  • Plugin Standard Guild to consume new telemetry once rolled out.

Communication

  • Daily async update in #guild-authority thread referencing this plan.
  • Link this document from docs/implplan/SPRINT_100_identity_signing.md notes once Phase 1 merges.