Commit 86c8a917 authored by Sergio Gimenez's avatar Sergio Gimenez
Browse files

docs: align FM persistence-model Security Design to ADR-0037 

Inbound/outbound AuthN/Z rows move from mTLS/cert-thumbprint to OAuth2
Client-Credentials + JWT (Keycloak federation realm). cert_thumbprint column is
retained as a future hook, removed from today's authorization decision. OPG
reference line corrected: OPG.04 Sec. 9 (authorization) primary; OPG.02
Sec. 2.4 / 4.2.3 / 3.3.4.5 (topology hiding + deferred mTLS).
parent ee725272

fm/persistence-model.md

+6 −5
Changes for fm/persistence-model.md: 6 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -275,14 +275,15 @@ federation-manager/ 


| Topic | Approach |

|---|---|

| Inbound AuthN | mTLS; Nginx terminates and forwards the client-cert thumbprint; FM matches `partner_ops.cert_thumbprint` |

| Admin AuthN/Z | Keycloak JWT, `operator` role, on `/internal/*` admin routes only |

| Outbound AuthN | our client cert (per-partner refs in `partner_ops`) verifying the partner CA |

| Inbound AuthN/Z | OAuth2 Client-Credentials + signed JWT via Keycloak `federation` realm (`fed-mgmt` scope); FM validates against Keycloak's JWKS (ADR-0037) |

| Admin AuthN/Z | Keycloak JWT, `operator` role, on `/internal/*` admin routes only — same centralized Keycloak, `oop` realm |

| Outbound AuthN | OAuth2 Client-Credentials — FM fetches a token from the partner's realm using our registered client credentials (ADR-0037) |

| Future: mTLS defense-in-depth | Deferred until real Nginx mTLS termination exists; `cert_thumbprint` column retained but not part of today's authorization decision (ADR-0037) |

| Topology hiding | mandatory `TopologyHider` on every EWBI response (REQ-FED-02); strips internal IPs, cluster/namespace/node names, pod UIDs, trace IDs |

| Correlation boundary | internal `correlation_id` ↔ external `X-Federation-Correlation-ID`; internal IDs never leave |

| Header trust | FM must be reachable only via Nginx, which must strip any client-supplied `X-Client-Certificate-Thumbprint` |

| Header trust | FM must be reachable only via Nginx, which must strip any client-supplied `X-Client-Certificate-Thumbprint` (relevant once the mTLS layer above is built) |



Reference: OPG.02 §2.4 (topology hiding), §4.2.2.3 (E/WBI authentication + agreed-resource exposure); OPG.04 EWBI.

Reference: OPG.04 v6.0 §9 (E/WBI OAuth2 Client-Credentials authorization — ADR-0037); OPG.02 v10.0 §2.4 (topology hiding), §4.2.3 (E/WBI authentication + agreed-resource exposure; not §4.2.2.3, corrected), §3.3.4.5 (mTLS as a mutually-agreed mechanism, deferred).



## Implementation Status