agentfootprint
Version:
The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.
43 lines (42 loc) • 2.66 kB
TypeScript
/**
* strategies/directoryChoice — `directory-password` from config: plain Active
* Directory over LDAPS, for a company with no federation server (design §4.5).
*
* Allowed in production (unlike `local-password`) — it is the company's real
* directory — and the banner says what it costs: a password bind skips
* whatever MFA the company's single sign-on enforces.
*
* Attempt limits come from AD's OWN lockout policy, which the AD admin
* supplies (review idI57 B-1, B-2, S-4):
* - **a THIRD of the threshold per ACCOUNT**, counted under the account the
* name reaches (`alice`, `ALICE`, `CORP\alice` and `alice@corp.example` are
* one budget), over a window that — like AD's own "reset account lockout
* counter after" — restarts from the LAST failure;
* - a third, not a half, because one AD account can have TWO logon names the
* door cannot tie together without a service account: the UPN prefix and
* the sAMAccountName (Jane: `jsmith@corp`, `jsmith2`). Two budgets of
* ⌊T/3⌋ still leave AD a third of its threshold for the person's VPN, mail
* and typos. The residual: an account with THREE distinct logon names (an
* alternative UPN suffix) could reach T through this door alone;
* - a threshold of 1 or 2 is REFUSED at boot — no budget of whole attempts
* stays under it — unless `IDENTITY_LDAP_ACCEPT_LOW_THRESHOLD=yes`, whose
* banner says the door cannot protect those accounts;
* - a threshold of 0 means AD never locks; the door keeps its default.
* This REDUCES lockout risk; it cannot rule it out (AD counts every source).
* The protection that holds whatever this door does is AD's own: a lockout
* DURATION of minutes, not "until an admin unlocks", and a threshold of 10 or
* more (the Microsoft security baseline's number).
*
* Trust (`IDENTITY_LDAP_CA_FILE`): a PEM file holding the ROOT CA, or exactly
* `system` — Node's default CA store, for a DC certificate a public CA issued.
* Never unset-means-system: an operator who forgot the key is refused, not
* quietly trusting every public CA. A file holding an INTERMEDIATE boots with
* a banner warning (it is replaced at renewal; trust the root).
*/
import { type LdaptsBackend } from '../directory/ldapDirectory.js';
import { type IdentityConfig } from './config.js';
import type { IdentityBootOptions, IdentityChoice } from './choose.js';
/** Build the `directory-password` choice, or refuse to boot naming the key. */
export declare function directoryPasswordChoice(config: IdentityConfig, boot: IdentityBootOptions & {
readonly ldapts?: LdaptsBackend;
}, production: boolean): IdentityChoice;