From 3a22708afa20b0f00d4619226766f655856cd11d Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 09:28:05 +0200 Subject: [PATCH 01/10] chore: preparation --- docs/deployment/deployment-overview.md | 4 + .../code-protoemds_final_stack/README.md | 157 ++++++++++++++++++ .../evidence-manifest.md | 42 +++++ 3 files changed, 203 insertions(+) create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md diff --git a/docs/deployment/deployment-overview.md b/docs/deployment/deployment-overview.md index a642efd6..28c5fcf4 100644 --- a/docs/deployment/deployment-overview.md +++ b/docs/deployment/deployment-overview.md @@ -9,3 +9,7 @@ Detailed deployment information should remain in the corresponding deployment re | Kubernetes deployment | https://github.com/deployEMDS/deployEMDS-k8s-deployment | TBD | To be completed | | Docker deployment | TBD | TBD | To be completed | | Infrastructure automation | TBD | TBD | To be completed | + +## Integration assessment documentation + +The reproducible security-assessment procedure and its sanitized evidence format are published in [`web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md`](../../web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md). The procedure pins the assessed deployment revision and links it to the corresponding test result without duplicating environment-specific deployment configuration. diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md new file mode 100644 index 00000000..75e591d3 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md @@ -0,0 +1,157 @@ +# Reproducible execution runbook: 4.2.1.6 + +This runbook defines how to assess encrypted DSP communication and connector authentication for the protoEMDS Final Stack. + +It is the execution companion to [`../test.md`](../test.md). The assessment record is [`../result_protoemds_final_stack.md`](../result_protoemds_final_stack.md), and the sanitized evidence index is [`../resources-protoemds_final_stack/evidence-manifest.md`](../resources-protoemds_final_stack/evidence-manifest.md). + +## Scope + +This runbook assesses only the two requirements of test `4.2.1.6`: + +1. The DSP negotiation channel is protected by TLS. +2. Connector authentication is performed for the data-sharing negotiation. + +Authorization to negotiation APIs, status messages, and logs is assessed separately by test `4.2.3.1`. Credential lifecycle, claims, usage policies, and UI login are not scored by this runbook. + +## Deployment baseline + +| Field | Value | +| --- | --- | +| Deployment model | CaaS / IONOS-managed deployment | +| Kubernetes context | `cluster-admin@EMDS-PROD` | +| Deployment repository | `deployEMDS-k8s-deployment` | +| Deployment branch | `prepare-prod` | +| Deployment revision | `846e5f1d7a388e664fe9e4942e553021752d63c6` | +| Expected DSP path | `https:///api/dsp` | +| Expected DID document path | `https:///.well-known/did.json` | +| Expected management path | `https:///api/management/` | + +The deployment revision is a baseline, not evidence of its current live state. Record the deployed Helm release names, image versions, routes, and certificate status before executing the protocol checks. + +## Safety and redaction + +- Use only the approved provider and consumer test connectors, test asset, and invalid/non-participant test identity. +- Do not run write, delete, patch, apply, rollout, or shell-exec Kubernetes commands for this assessment. +- Do not put kubeconfig content, tokens, API keys, passwords, Vault material, unredacted logs, full certificate chains, internal IP addresses, or personal data in this repository. +- Do not use `curl --insecure` as evidence of TLS. Certificate hostname and trust validation must succeed without it. +- Store complete operational captures in the approved protected evidence store. Commit only sanitized summaries and hashes listed in the evidence manifest. + +## Required inputs + +Set only non-secret values in the current shell. Do not export secrets into shell history. + +```sh +export KUBE_CONTEXT='cluster-admin@EMDS-PROD' +export PROVIDER_HOST='' +export CONSUMER_HOST='' +export PROVIDER_DID='did:web:' +export CONSUMER_DID='did:web:' +export DEPLOYMENT_REVISION='846e5f1d7a388e664fe9e4942e553021752d63c6' +``` + +Obtain the authenticated negotiation procedure and the approved invalid/non-participant input from the connector owner. The installed EDC authentication mechanism must be identified before a protocol request is sent; do not infer it from the management API authentication mechanism. + +## Step 1: capture the live environment inventory + +Run read-only resource discovery. Do not retrieve Secret data. + +```sh +kubectl --context "$KUBE_CONTEXT" get ns +kubectl --context "$KUBE_CONTEXT" get deploy,sts,ds,svc,ingress,certificate -A +kubectl --context "$KUBE_CONTEXT" get gateway,httproute -A +kubectl --context "$KUBE_CONTEXT" get networkpolicy -A +helm --kube-context "$KUBE_CONTEXT" list --all-namespaces +``` + +Record, after redaction: + +- namespaces and connector Helm release names; +- connector control-plane, data-plane, identity-hub, STS, and proxy workload image versions; +- public Ingress or Gateway hostnames and TLS certificate readiness; +- the provider and consumer `did:web` values; and +- the deployed observability service used for trace correlation. + +Expected outcome: two intended connector tenants and their public routes can be identified, and the TLS certificate resource or trusted public certificate can be associated with each DSP hostname. + +## Step 2: validate DID documents and TLS + +The DID document establishes the expected protocol endpoint. Retrieve it over HTTPS and validate its advertised endpoint before checking the DSP route. + +```sh +curl --fail --silent --show-error \ + "https://$PROVIDER_HOST/.well-known/did.json" +curl --fail --silent --show-error \ + "https://$CONSUMER_HOST/.well-known/did.json" + +openssl s_client -connect "$PROVIDER_HOST:443" -servername "$PROVIDER_HOST" \ + -verify_return_error /api/dsp`. + +## Step 3: verify plaintext is not a usable DSP channel + +Use a harmless `HEAD` request and do not follow redirects automatically. + +```sh +curl --head --silent --show-error --output /dev/null --write-out '%{http_code}\n' \ + "http://$PROVIDER_HOST/api/dsp" +curl --head --silent --show-error --output /dev/null --write-out '%{http_code}\n' \ + "http://$CONSUMER_HOST/api/dsp" +``` + +Expected outcome: HTTP is redirected to HTTPS, rejected, or unavailable. It must not provide a usable plaintext DSP negotiation route. + +## Step 4: execute and correlate an authenticated negotiation + +Execute one approved provider-consumer negotiation using the connector owner's documented client procedure. Do not place request credentials or credential presentations in this repository. + +Record the following in a sanitized correlation table: + +| Field | Required evidence | +| --- | --- | +| Initiating connector | Consumer DID or approved redacted identifier | +| Counterparty connector | Provider DID or approved redacted identifier | +| Transport endpoint | HTTPS DSP URL | +| Negotiation identifier | Redacted identifier or deterministic hash | +| Authentication result | Accepted connector/participant identity mechanism | +| Provider evidence | Sanitized log or trace reference | +| Consumer evidence | Sanitized log or trace reference | +| Outcome | Negotiation processed or rejected | + +Expected outcome: a negotiation sent over the discovered HTTPS DSP URL is processed by the intended counterparty, and provider and consumer observations can be correlated by a non-sensitive negotiation or trace identifier. + +## Step 5: run approved negative controls + +Run only with approved test identities and non-production test assets. + +| Check | Method | Expected outcome | +| --- | --- | --- | +| Management API without valid local credentials | Harmless read-only request to `/api/management/` | Denied; do not treat management credentials as DSP authentication evidence. | +| DSP negotiation with invalid or non-participant identity | Connector-owner-approved invalid negotiation request | Denied before a contract negotiation proceeds. | +| Plaintext DSP route | Step 3 HTTP `HEAD` request | Redirected, rejected, or unavailable. | + +Record only request category, status/result, timestamp, and correlated sanitized evidence reference. Do not record tokens, request bodies containing credentials, or full response bodies. + +## Step 6: determine the score + +| Score | Evidence threshold | +| ---: | --- | +| 0 | Neither encrypted DSP communication nor connector authentication is demonstrated. | +| 1 | Only partial or configuration-only evidence is available. | +| 2 | Exactly one of TLS or connector authentication is demonstrated live. | +| 3 | Both are demonstrated live, but a material limitation remains. | +| 4 | Valid TLS, successful authenticated negotiation, approved authentication failure control, and end-to-end correlation are all demonstrated. | + +Document unavailable controls as limitations. Do not assign a score from Helm values or Ingress configuration alone. + +## Evidence completion + +1. Add a row for each executed step to [`../resources-protoemds_final_stack/evidence-manifest.md`](../resources-protoemds_final_stack/evidence-manifest.md). +2. Commit sanitized artifacts only after a second reviewer confirms redaction. +3. Complete [`../result_protoemds_final_stack.md`](../result_protoemds_final_stack.md) with the selected score, CaaS assessment, and evidence links. +4. Mark the on-premise deployment `Not assessed` unless separate on-premise evidence is collected. diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md new file mode 100644 index 00000000..a1ee011f --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -0,0 +1,42 @@ +# Evidence manifest: 4.2.1.6 protoEMDS Final Stack + +This manifest indexes the sanitized, versioned evidence for the CaaS assessment. It is intentionally empty until the live assessment is performed. + +## Redaction rules + +Do not commit secrets, credentials, bearer tokens, API keys, passwords, Vault material, kubeconfig data, internal IP addresses, full certificate chains, personal data, or unredacted application logs. Keep complete source captures in the approved protected evidence store. + +Each committed artifact must state the capture date, executing role, command category, source capture reference, and SHA-256 hash of the protected original or sanitized capture, as appropriate. + +## Deployment baseline + +| Field | Value | +| --- | --- | +| Deployment model | CaaS / IONOS-managed deployment | +| Kubernetes context | `cluster-admin@EMDS-PROD` | +| Deployment repository | `deployEMDS-k8s-deployment` | +| Deployment branch | `prepare-prod` | +| Deployment revision | `846e5f1d7a388e664fe9e4942e553021752d63c6` | +| Assessment status | Pending live evidence collection | + +## Evidence index + +| ID | Test step | Sanitized artifact | Protected source reference | SHA-256 | Capture date | Reviewer | Status | +| --- | --- | --- | --- | --- | --- | --- | --- | +| ENV-01 | Live environment inventory | TBD | TBD | TBD | TBD | TBD | Pending | +| TLS-01 | Provider DID document and certificate validation | TBD | TBD | TBD | TBD | TBD | Pending | +| TLS-02 | Consumer DID document and certificate validation | TBD | TBD | TBD | TBD | TBD | Pending | +| TLS-03 | Plaintext DSP negative control | TBD | TBD | TBD | TBD | TBD | Pending | +| NEG-01 | Successful authenticated provider-consumer negotiation | TBD | TBD | TBD | TBD | TBD | Pending | +| NEG-02 | Invalid or non-participant DSP authentication control | TBD | TBD | TBD | TBD | TBD | Pending | +| NEG-03 | Management API local-authentication control | TBD | TBD | TBD | TBD | TBD | Pending | + +## Negotiation correlation table + +| Run ID | Initiator | Counterparty | HTTPS DSP endpoint | Negotiation or trace ID | Authentication result | Provider evidence | Consumer evidence | Outcome | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | Pending | + +## Cross-test handoff + +Evidence about authorization to negotiation APIs, status messages, or logs must be recorded for test `4.2.3.1`; it is not evidence for the score of this test. Credential lifecycle evidence belongs to test `1.3.1.5`. From 05995a7b4d32cb2358824bb3668301b90016438a Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 09:31:07 +0200 Subject: [PATCH 02/10] chore: add final stack to web/tech-testing/deployment --- ...otoemds-final-stack-security-assessment.md | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md diff --git a/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md b/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md new file mode 100644 index 00000000..8fecef5e --- /dev/null +++ b/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md @@ -0,0 +1,46 @@ +--- +sidebar_position: 3 +--- + +# protoEMDS final stack security assessment + +The protoEMDS Final Stack assessment uses the existing stack-agnostic test catalogue and records a separate integration-phase result for the deployed EDC-based infrastructure. + +For reproducibility, each assessment has three linked artifacts: + +1. The test-local runbook documents prerequisites, safe commands, expected observations, and scoring rules. +2. The versioned evidence manifest indexes sanitized command outputs, TLS observations, and negotiation correlation records. +3. The result file records the deployment model, assessment outcome, limitations, and selected score. + +The Kubernetes deployment itself remains authoritative in the `deployEMDS-k8s-deployment` repository. An assessment must pin the exact deployment branch and commit it evaluated rather than copying Helm values, credentials, or environment-specific configuration into this repository. + +## Security and restricted access + +Test `4.2.1.6` assesses encrypted DSP negotiation and connector authentication. Its reproducibility pack is located at: + +```text +tests/sharing_agreement/negotiation/negotiating_sharing_agreement/ +test_4_2_1_6/ +├── code-protoemds_final_stack/README.md +├── resources-protoemds_final_stack/evidence-manifest.md +└── result_protoemds_final_stack.md +``` + +The assessment is designed for the IONOS-managed CaaS deployment and distinguishes it from any on-premise assessment. The currently pinned deployment baseline is branch `prepare-prod` at commit `846e5f1d7a388e664fe9e4942e553021752d63c6` of `deployEMDS-k8s-deployment`. + +The expected public connector paths are: + +| Capability | Path | +| --- | --- | +| DSP | `/api/dsp` | +| Management API | `/api/management/` | +| DID document | `/.well-known/did.json` | +| Connector UI | `/dashboard/` | + +TLS and protocol authentication must be demonstrated by live evidence. Deployment manifests, Ingress annotations, and certificate configuration are supporting evidence only. + +## Evidence handling + +Commit concise sanitized evidence that another partner can map back to each runbook step. Keep raw logs, traces, certificates, credentials, kubeconfig, tokens, secret values, and internal network details in the approved protected evidence store. Each manifest row should include a stable protected-source reference and SHA-256 hash. + +Test `4.2.3.1` owns authorization checks for negotiation APIs, status messages, and logs. Identity and credential lifecycle evidence belongs to test `1.3.1.5`; neither should inflate the `4.2.1.6` score. From b839e628d0c475ddc97aa43e0e9843acb8aad970 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 09:54:19 +0200 Subject: [PATCH 03/10] chore: first test results --- ...th-01-live-authentication-configuration.md | 35 +++++++++++++++ .../env-01-live-cluster-inventory.md | 43 +++++++++++++++++++ .../evidence-manifest.md | 19 +++++--- .../neg-03-unauthenticated-management-api.md | 23 ++++++++++ .../tls-01-connector-a-did-and-certificate.md | 30 +++++++++++++ .../tls-02-connector-b-did-and-certificate.md | 30 +++++++++++++ .../result_protoemds_final_stack.md | 18 +++++--- 7 files changed, 184 insertions(+), 14 deletions(-) create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-01-live-authentication-configuration.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/env-01-live-cluster-inventory.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/neg-03-unauthenticated-management-api.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-01-live-authentication-configuration.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-01-live-authentication-configuration.md new file mode 100644 index 00000000..32079196 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-01-live-authentication-configuration.md @@ -0,0 +1,35 @@ +# AUTH-01: live authentication configuration summary + +| Field | connector-a | connector-b | +| --- | --- | --- | +| Capture date | 2026-08-13 | 2026-08-13 | +| Participant and issuer identity | `did:web:connector-a.194-164-194-95.sslip.io` | `did:web:connector-b.194-164-194-95.sslip.io` | +| DSP callback address | `https://connector-a.194-164-194-95.sslip.io/api/dsp` | `https://connector-b.194-164-194-95.sslip.io/api/dsp` | +| DID web HTTPS enforcement | Enabled | Enabled | +| STS token service | Configured | Configured | +| OpenTelemetry traces | Enabled | Enabled | + +The inspected control-plane configuration associates each connector with a `did:web` participant identity, configures a local STS token service, and enables OpenTelemetry tracing. It is supporting evidence for the deployed authentication architecture, not proof of an authenticated DSP negotiation. + +## Security observation and handoff + +During the non-secret ConfigMap inspection, a credential-like configuration value was visible in a ConfigMap. Its name and value are intentionally omitted from this artifact. Configuration values that function as credentials must be kept in a Kubernetes Secret or an approved secret manager rather than a ConfigMap. This observation is outside the score of test `4.2.1.6` and must be handed to the owner of test `4.2.3.1` and the deployment owner for remediation. + +## Collection method + +Only explicitly selected, non-secret architecture values were recorded. No Secret was read and no credential-bearing ConfigMap value is retained in this artifact. + +```sh +for configmap in connector-a-controlplane connector-b-controlplane + kubectl --context cluster-admin@EMDS-PROD get configmap "$configmap" \ + -n connector -o json | jq '.data | { + EDC_DSP_CALLBACK_ADDRESS, + EDC_IAM_DID_WEB_USE_HTTPS, + EDC_IAM_ISSUER_ID, + EDC_IAM_STS_OAUTH_TOKEN_URL, + EDC_PARTICIPANT_ID, + OTEL_AGENT_ENABLED, + OTEL_TRACES_EXPORTER + }' +end +``` diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/env-01-live-cluster-inventory.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/env-01-live-cluster-inventory.md new file mode 100644 index 00000000..6140ba4e --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/env-01-live-cluster-inventory.md @@ -0,0 +1,43 @@ +# ENV-01: live cluster inventory + +| Field | Observed value | +| --- | --- | +| Capture date | 2026-08-13 | +| Kubernetes context | `cluster-admin@EMDS-PROD` | +| Deployment model | CaaS / IONOS-managed deployment | +| Deployment namespace | `connector` | +| Connector releases | `connector-a`, `connector-b` | +| Connector chart | `edc-i2cat-1.0.0` | +| Connector image revision | `9916cc56b682ae70988300d301b752ca8eb05121` | +| Control-plane base image | `ghcr.io/deployemds/emds-edc-connector:controlplane-9916cc56b682ae70988300d301b752ca8eb05121` | +| Identity-hub base image | `ghcr.io/deployemds/emds-edc-connector:identity-hub-9916cc56b682ae70988300d301b752ca8eb05121` | +| Data-plane base image | `ghcr.io/deployemds/emds-edc-connector:dataplane-9916cc56b682ae70988300d301b752ca8eb05121` | +| Observability namespace | `observa` | +| Observability components | OpenTelemetry Collector, Jaeger, Elasticsearch, Kibana, Health Monitor | + +## Connector readiness and public routes + +| Connector | Control plane | Identity hub | NGINX proxy | Ingress hostname | Certificate | +| --- | --- | --- | --- | --- | --- | +| `connector-a` | Ready `1/1` | Ready `1/1` | Ready `1/1` | `connector-a.194-164-194-95.sslip.io` | `connector-a-tls`: Ready, `letsencrypt-prod`, not expired | +| `connector-b` | Ready `1/1` | Ready `1/1` | Ready `1/1` | `connector-b.194-164-194-95.sslip.io` | `connector-b-tls`: Ready, `letsencrypt-prod`, not expired | + +Both ingress resources use the `nginx` class, expose ports `80` and `443`, and resolve through the same public ingress address. No Gateway API resources are installed. No NetworkPolicy resources were returned for the `connector` namespace. + +## Release and observability status + +`connector-a` is a deployed Helm release. `connector-b` is reported as `failed` by Helm, although all inspected connector workloads and pods were ready and running. This discrepancy must be reviewed with the deployment owner, but it does not currently prevent read-only TLS or DSP reachability checks. + +The `observa` Helm release is also reported as `failed`; its inspected Elasticsearch, Jaeger, Kibana, OpenTelemetry Collector, and Health Monitor deployments were all ready and their pods were running. Trace correlation can therefore be attempted, subject to the deployed access path. + +## Collection method + +The inventory was collected without reading Secret data or modifying the cluster using: + +```sh +kubectl --context cluster-admin@EMDS-PROD get ns +helm --kube-context cluster-admin@EMDS-PROD list --all-namespaces +kubectl --context cluster-admin@EMDS-PROD get deploy,sts,ds,pods,svc,ingress,certificate -n connector -o wide +kubectl --context cluster-admin@EMDS-PROD get deploy,sts,ds,pods,svc,ingress,certificate -n observa -o wide +kubectl --context cluster-admin@EMDS-PROD get networkpolicy -n connector -o wide +``` \ No newline at end of file diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md index a1ee011f..aaefe07a 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -1,6 +1,6 @@ # Evidence manifest: 4.2.1.6 protoEMDS Final Stack -This manifest indexes the sanitized, versioned evidence for the CaaS assessment. It is intentionally empty until the live assessment is performed. +This manifest indexes the sanitized, versioned evidence for the CaaS assessment. Live evidence collection is in progress. ## Redaction rules @@ -17,19 +17,24 @@ Each committed artifact must state the capture date, executing role, command cat | Deployment repository | `deployEMDS-k8s-deployment` | | Deployment branch | `prepare-prod` | | Deployment revision | `846e5f1d7a388e664fe9e4942e553021752d63c6` | -| Assessment status | Pending live evidence collection | +| Assessment status | Live evidence collection in progress | ## Evidence index | ID | Test step | Sanitized artifact | Protected source reference | SHA-256 | Capture date | Reviewer | Status | | --- | --- | --- | --- | --- | --- | --- | --- | -| ENV-01 | Live environment inventory | TBD | TBD | TBD | TBD | TBD | Pending | -| TLS-01 | Provider DID document and certificate validation | TBD | TBD | TBD | TBD | TBD | Pending | -| TLS-02 | Consumer DID document and certificate validation | TBD | TBD | TBD | TBD | TBD | Pending | -| TLS-03 | Plaintext DSP negative control | TBD | TBD | TBD | TBD | TBD | Pending | +| ENV-01 | Live environment inventory | [`env-01-live-cluster-inventory.md`](./env-01-live-cluster-inventory.md) | Sanitized terminal capture; no protected source retained | `1cc7c69d5ad98ec5803b84f0c5aa06abf8100321a21180e380c37cea9449c529` | 2026-08-13 | Pending | Collected; review Helm release status before final assessment | +| AUTH-01 | Live DSP authentication architecture | [`auth-01-live-authentication-configuration.md`](./auth-01-live-authentication-configuration.md) | Sanitized terminal capture; no protected source retained | `198c7523a8e2d77cc598a24469fc7751385d3a2355562f41ccbb0db2dde757ac` | 2026-08-13 | Pending | Collected; supporting configuration evidence only | +| TLS-01 | connector-a DID document and certificate validation | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `68b199d85a0a59ac47acb2d9fdb99ee8ee6eb4a8f5b55baaabf64b5666d7667f` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | +| TLS-02 | connector-b DID document and certificate validation | [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `2db85e4473a16f25a8b0a985156bbfc4c51b9cfd49a71a0cd54e16cc15f5c994` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | +| TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | See TLS-01 and TLS-02 | 2026-08-13 | Pending | Collected; both HTTP DSP routes return `308` redirects to HTTPS | | NEG-01 | Successful authenticated provider-consumer negotiation | TBD | TBD | TBD | TBD | TBD | Pending | | NEG-02 | Invalid or non-participant DSP authentication control | TBD | TBD | TBD | TBD | TBD | Pending | -| NEG-03 | Management API local-authentication control | TBD | TBD | TBD | TBD | TBD | Pending | +| NEG-03 | Management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | Sanitized terminal capture; no protected source retained | `615b1dca5b6d0b85a0d818301921910b24efd1bec73279beddf73ad5aa849ef7` | 2026-08-13 | Pending | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized` | + +## Open evidence items + +`NEG-01` and `NEG-02` require an approved test asset, the connector owner's authenticated negotiation procedure, and an approved invalid or non-participant test identity. They must not be attempted with discovered configuration credentials or an unapproved asset because an EDC negotiation creates state. Until both controls are collected and correlated in the configured observability stack, no final score can be assigned for connector authentication. ## Negotiation correlation table diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/neg-03-unauthenticated-management-api.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/neg-03-unauthenticated-management-api.md new file mode 100644 index 00000000..07e62980 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/neg-03-unauthenticated-management-api.md @@ -0,0 +1,23 @@ +# NEG-03: unauthenticated management API control + +| Field | connector-a | connector-b | +| --- | --- | --- | +| Capture date | 2026-08-13 | 2026-08-13 | +| Request | `POST /api/management/v3/assets/request` | `POST /api/management/v3/assets/request` | +| Credentials supplied | None | None | +| Request body | Minimal read-only pagination query | Minimal read-only pagination query | +| Response | `401 Unauthorized` | `401 Unauthorized` | + +The management API denied an unauthenticated read-only asset-query request for both connectors. This demonstrates local management API authentication enforcement, but it is not proof of DSP connector authentication and does not determine the `4.2.1.6` score. + +An initial `GET` request to `/api/management/v3/assets` returned `405 Method Not Allowed`; it was not used as authentication evidence. The recorded `POST` request uses the EDC asset-query method and was denied before any asset data was returned. + +## Collection method + +```sh +curl --silent --show-error --output /dev/null --write-out 'HTTP %{http_code}\n' \ + --request POST \ + --header 'Content-Type: application/json' \ + --data '{"offset":0,"limit":1}' \ + https:///api/management/v3/assets/request +``` diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md new file mode 100644 index 00000000..0162a9d7 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md @@ -0,0 +1,30 @@ +# TLS-01: connector-a DID and certificate validation + +| Field | Observed value | +| --- | --- | +| Capture date | 2026-08-13 | +| Connector DID | `did:web:connector-a.194-164-194-95.sslip.io` | +| DSP endpoint advertised by DID document | `https://connector-a.194-164-194-95.sslip.io/api/dsp` | +| Certificate subject | `CN=connector-a.194-164-194-95.sslip.io` | +| Certificate issuer | `C=US, O=Let's Encrypt, CN=YR1` | +| TLS protocol | `TLSv1.3` | +| Cipher | `TLS_AES_256_GCM_SHA384` | +| Hostname and chain verification | `Verify return code: 0 (ok)` | +| Plaintext DSP result | `HTTP 308` redirect to the HTTPS DSP endpoint | + +## Collection method + +```sh +curl --fail --silent --show-error \ + https://connector-a.194-164-194-95.sslip.io/.well-known/did.json +openssl s_client \ + -connect connector-a.194-164-194-95.sslip.io:443 \ + -servername connector-a.194-164-194-95.sslip.io \ + -verify_hostname connector-a.194-164-194-95.sslip.io \ + -verify_return_error based on eclipse edc connector `0.10.0` | +| Connector deployment reference | `deployEMDS-k8s-deployment`, branch `prepare-prod`, commit `846e5f1d7a388e664fe9e4942e553021752d63c6` | +| Assessment evidence | Pending. See [`code-protoemds_final_stack/README.md`](./code-protoemds_final_stack/README.md) and [`resources-protoemds_final_stack/evidence-manifest.md`](./resources-protoemds_final_stack/evidence-manifest.md). | The assessment should be completed using the deployment model for which evidence is realistically available. It is not mandatory to execute the same test in both CaaS and on-premise environments. @@ -37,6 +37,8 @@ It does not replace the historical stack-specific result files, such as `result_ The quality metric, expected output and comparative criteria remain those defined by the original test. This result file should only capture the evidence and assessment outcome for the selected protoEMDS Final Stack deployment. +The reproducible execution procedure is in [`code-protoemds_final_stack/README.md`](./code-protoemds_final_stack/README.md) and [`resources-protoemds_final_stack/evidence-manifest.md`](./resources-protoemds_final_stack/evidence-manifest.md). + #### Test-specific assessment scope Validate that the data sharing protocol is compatible with channel encryption (e.g. TLS), that a connector authentication has taken place exclusively for the data sharing negotiation. @@ -84,4 +86,6 @@ The assessment should be completed using consolidated technical evidence, such a This result file was generated from the local `test.md` and, where available, the local `result_edc_vc.md` structure. EDC+VC-specific evidence, values and scores were intentionally not reused. +The test-local runbook and evidence manifest are versioned with this result to enable replication without exposing credentials, cluster configuration, raw logs or other sensitive operational information. + From 1f663c4abb3e41ed39b606ac3b1352a58718fd80 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 10:37:59 +0200 Subject: [PATCH 04/10] chore: k8s adoption --- .../code-protoemds_final_stack/README.md | 71 +++++++++++-------- ...ubernetes-runtime-configuration-binding.md | 53 ++++++++++++++ .../evidence-manifest.md | 17 ++--- 3 files changed, 102 insertions(+), 39 deletions(-) create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md index 75e591d3..55c7914b 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md @@ -6,12 +6,12 @@ It is the execution companion to [`../test.md`](../test.md). The assessment reco ## Scope -This runbook assesses only the two requirements of test `4.2.1.6`: +This runbook assesses the following within the agreed Security and Restricted Access scope for test `4.2.1.6`: 1. The DSP negotiation channel is protected by TLS. -2. Connector authentication is performed for the data-sharing negotiation. +2. The deployed DSP identity and authentication architecture is present and operationally evidenced. -Authorization to negotiation APIs, status messages, and logs is assessed separately by test `4.2.3.1`. Credential lifecycle, claims, usage policies, and UI login are not scored by this runbook. +This assessment does not execute a contract negotiation. Contract definition using claims, usage policies, and service agreements belongs to [test `4.2.1.3`](../../test_4_2_1_3/test.md). Authorization to negotiation APIs, status messages, and logs is assessed separately by [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Credential lifecycle and UI login are also not scored by this runbook. ## Deployment baseline @@ -30,7 +30,6 @@ The deployment revision is a baseline, not evidence of its current live state. R ## Safety and redaction -- Use only the approved provider and consumer test connectors, test asset, and invalid/non-participant test identity. - Do not run write, delete, patch, apply, rollout, or shell-exec Kubernetes commands for this assessment. - Do not put kubeconfig content, tokens, API keys, passwords, Vault material, unredacted logs, full certificate chains, internal IP addresses, or personal data in this repository. - Do not use `curl --insecure` as evidence of TLS. Certificate hostname and trust validation must succeed without it. @@ -49,7 +48,20 @@ export CONSUMER_DID='did:web:' export DEPLOYMENT_REVISION='846e5f1d7a388e664fe9e4942e553021752d63c6' ``` -Obtain the authenticated negotiation procedure and the approved invalid/non-participant input from the connector owner. The installed EDC authentication mechanism must be identified before a protocol request is sent; do not infer it from the management API authentication mechanism. +Identify the deployed DSP authentication mechanism from non-secret configuration and public DID evidence. Do not infer DSP authentication from the management API authentication mechanism. + +## Effective runtime configuration evidence + +Configuration source files and deployment manifests show intended configuration. This test also requires evidence that the running connector consumes the intended configuration source. Record the deployment-specific mechanism used and any limitation on process-level verification. + +| Deployment model | Effective configuration evidence | +| --- | --- | +| Kubernetes | Workload template binding to ConfigMaps, Secrets, or mounted files; observed Deployment revision; and a ready running Pod created from that template. | +| Docker or Docker Compose | Running container image/ID plus its non-secret environment and mounted configuration-file bindings. | +| VM or bare metal | Running service/process status plus the rendered properties file or service-unit environment it consumes. | +| Managed platform | Deployed revision, platform configuration export, and running health/status evidence. | + +An approved non-sensitive diagnostics endpoint, startup log, or allow-listed runtime environment inspection may provide stronger process-level confirmation. Never run an unfiltered environment dump or read secret values. If process-level inspection is unavailable, state that the evidence proves configuration delivery to the runtime rather than the exact effective process environment. ## Step 1: capture the live environment inventory @@ -69,7 +81,7 @@ Record, after redaction: - connector control-plane, data-plane, identity-hub, STS, and proxy workload image versions; - public Ingress or Gateway hostnames and TLS certificate readiness; - the provider and consumer `did:web` values; and -- the deployed observability service used for trace correlation. +- the deployed STS and observability components. Expected outcome: two intended connector tenants and their public routes can be identified, and the TLS certificate resource or trusted public certificate can be associated with each DSP hostname. @@ -106,48 +118,51 @@ curl --head --silent --show-error --output /dev/null --write-out '%{http_code}\n Expected outcome: HTTP is redirected to HTTPS, rejected, or unavailable. It must not provide a usable plaintext DSP negotiation route. -## Step 4: execute and correlate an authenticated negotiation +## Step 4: verify effective DSP identity and authentication configuration -Execute one approved provider-consumer negotiation using the connector owner's documented client procedure. Do not place request credentials or credential presentations in this repository. +Establish the configuration-delivery chain from the deployment-specific source to a ready connector runtime. For Kubernetes, inspect the control-plane Deployment template for ConfigMap, Secret, or mounted-file bindings; record its observed generation and a ready Pod controlled by that template. For other deployment models, use the equivalent evidence listed above. -Record the following in a sanitized correlation table: +Then inspect non-secret identity/authentication values and public DID documents. Record only the following: | Field | Required evidence | | --- | --- | -| Initiating connector | Consumer DID or approved redacted identifier | -| Counterparty connector | Provider DID or approved redacted identifier | -| Transport endpoint | HTTPS DSP URL | -| Negotiation identifier | Redacted identifier or deterministic hash | -| Authentication result | Accepted connector/participant identity mechanism | -| Provider evidence | Sanitized log or trace reference | -| Consumer evidence | Sanitized log or trace reference | -| Outcome | Negotiation processed or rejected | +| Runtime configuration delivery | Deployment-specific source binding and ready runtime revision | +| Connector identity | `did:web` participant and issuer identifier | +| DSP identity binding | HTTPS DSP callback address and DID `ProtocolEndpoint` | +| Authentication component | Configured STS token-service endpoint | +| Trace support | Enabled OpenTelemetry configuration | -Expected outcome: a negotiation sent over the discovered HTTPS DSP URL is processed by the intended counterparty, and provider and consumer observations can be correlated by a non-sensitive negotiation or trace identifier. +Expected outcome: each connector's public DID, delivered runtime configuration, and control-plane configuration consistently identify the HTTPS DSP endpoint and the deployed identity/authentication components. + +When a deployment injects secrets, record only the Secret reference and required key names. Do not read or print Secret values. A local management API key is supporting management-access evidence and must not be presented as DSP connector-authentication evidence. + +Where permitted, Kubernetes may provide stronger process-level evidence using `kubectl exec` with a fixed allow-list. Do not run `printenv` or `env` without selecting named variables first. + +```sh +kubectl --context "$KUBE_CONTEXT" exec -n connector \ + -c controlplane -- sh -c \ + 'for name in EDC_DSP_CALLBACK_ADDRESS EDC_IAM_DID_WEB_USE_HTTPS EDC_IAM_ISSUER_ID EDC_IAM_STS_OAUTH_TOKEN_URL EDC_PARTICIPANT_ID OTEL_TRACES_EXPORTER; do printenv "$name"; done' +``` -## Step 5: run approved negative controls +## Step 5: verify supporting local management API authentication -Run only with approved test identities and non-production test assets. +Use a harmless, read-only request without credentials. | Check | Method | Expected outcome | | --- | --- | --- | | Management API without valid local credentials | Harmless read-only request to `/api/management/` | Denied; do not treat management credentials as DSP authentication evidence. | -| DSP negotiation with invalid or non-participant identity | Connector-owner-approved invalid negotiation request | Denied before a contract negotiation proceeds. | -| Plaintext DSP route | Step 3 HTTP `HEAD` request | Redirected, rejected, or unavailable. | -Record only request category, status/result, timestamp, and correlated sanitized evidence reference. Do not record tokens, request bodies containing credentials, or full response bodies. +Record only the request category, status/result, and sanitized evidence reference. Do not record tokens or full response bodies. ## Step 6: determine the score | Score | Evidence threshold | | ---: | --- | | 0 | Neither encrypted DSP communication nor connector authentication is demonstrated. | -| 1 | Only partial or configuration-only evidence is available. | -| 2 | Exactly one of TLS or connector authentication is demonstrated live. | -| 3 | Both are demonstrated live, but a material limitation remains. | -| 4 | Valid TLS, successful authenticated negotiation, approved authentication failure control, and end-to-end correlation are all demonstrated. | +| 1 | TLS or the deployed DSP identity/authentication architecture is only partially evidenced. | +| 2 | Valid TLS is demonstrated for both DSP endpoints and the deployed DSP identity/authentication architecture is consistently evidenced by public DID, non-secret configuration, and runtime configuration delivery. | -Document unavailable controls as limitations. Do not assign a score from Helm values or Ingress configuration alone. +Within this non-negotiation scope, the assessment is capped at `2` (Partial Coverage). A score above `2` would require proof that connector authentication occurred during a live negotiation, which is outside this test execution scope. Do not assign a score from Helm values or Ingress configuration alone. ## Evidence completion diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md new file mode 100644 index 00000000..a14bb0d1 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md @@ -0,0 +1,53 @@ +# AUTH-02: Kubernetes runtime configuration binding + +This evidence verifies configuration delivery to the running Kubernetes control planes and confirms an allow-listed set of non-secret environment variables. It does not read Secret values. + +| Field | connector-a | connector-b | +| --- | --- | --- | +| Capture date | 2026-08-13 | 2026-08-13 | +| Control-plane Deployment | `connector-a-controlplane` | `connector-b-controlplane` | +| Deployment generation / observed generation | `4 / 4` | `2 / 2` | +| Ready replicas | `1` | `1` | +| ConfigMap imported through `envFrom` | `connector-a-controlplane` | `connector-b-controlplane` | +| Required non-secret keys present in source ConfigMap | DSP callback, DID issuer, participant ID, STS token URL, OpenTelemetry traces | DSP callback, DID issuer, participant ID, STS token URL, OpenTelemetry traces | +| Ready control-plane Pod | `connector-a-controlplane-7cf9b77f66-v4rjf` | `connector-b-controlplane-95f45f8b4-xg74v` | +| Pod state | `Running`, control-plane container ready | `Running`, control-plane container ready | +| Control-plane image | `ghcr.io/deployemds/emds-edc-connector:controlplane-9916cc56b682ae70988300d301b752ca8eb05121` | `ghcr.io/deployemds/emds-edc-connector:controlplane-9916cc56b682ae70988300d301b752ca8eb05121` | +| Management-auth Secret reference | `connector-a-db-credentials` | `connector-b-db-credentials` | +| Required referenced Secret keys present | `EDC_API_KEY`, `CONNECTOR_DB_PASSWORD` | `EDC_API_KEY`, `CONNECTOR_DB_PASSWORD` | +| Runtime DSP callback address | `https://connector-a.194-164-194-95.sslip.io/api/dsp` | `https://connector-b.194-164-194-95.sslip.io/api/dsp` | +| Runtime DID web HTTPS setting | `true` | `true` | +| Runtime issuer and participant ID | `did:web:connector-a.194-164-194-95.sslip.io` | `did:web:connector-b.194-164-194-95.sslip.io` | +| Runtime STS token URL | `http://connector-a-sts:8082/api/sts/token` | `http://connector-b-sts:8082/api/sts/token` | +| Runtime trace exporter | `otlp` | `otlp` | + +The Kubernetes Deployment templates bind their corresponding non-secret control-plane ConfigMaps through `envFrom`. Their observed generations match their desired generations, and each controls a ready running Pod using the recorded image. An allow-listed process-environment inspection confirmed that both ready control-plane containers received the expected DSP, DID, STS, and OpenTelemetry values. + +The Deployment templates also reference the corresponding `Opaque` credential Secret for `EDC_API_KEY` and `CONNECTOR_DB_PASSWORD`, and both named keys exist in the referenced Secret objects. Secret values were not read. `EDC_API_KEY` supports the local management API authentication control only; it is not DSP connector-authentication evidence. + +Only the six listed non-secret variables were printed. No unfiltered environment dump or Secret read was performed. This evidence confirms the selected runtime settings, but is not proof of a completed DSP authentication exchange. + +## Collection method + +The commands below query deployment, Pod, selected non-secret ConfigMap metadata, and Secret metadata/key names, then print only an allow-listed set of non-secret environment variables. They do not retrieve Secret values. + +```sh +kubectl --context cluster-admin@EMDS-PROD get deployment \ + connector-a-controlplane connector-b-controlplane \ + -n connector -o json + +kubectl --context cluster-admin@EMDS-PROD get pods \ + -n connector -l app.kubernetes.io/name=controlplane -o json + +kubectl --context cluster-admin@EMDS-PROD get configmap \ + connector-a-controlplane connector-b-controlplane \ + -n connector -o json + +kubectl --context cluster-admin@EMDS-PROD get secret \ + connector-a-db-credentials connector-b-db-credentials \ + -n connector -o json + +kubectl --context cluster-admin@EMDS-PROD exec -n connector \ + -c controlplane -- sh -c \ + 'for name in EDC_DSP_CALLBACK_ADDRESS EDC_IAM_DID_WEB_USE_HTTPS EDC_IAM_ISSUER_ID EDC_IAM_STS_OAUTH_TOKEN_URL EDC_PARTICIPANT_ID OTEL_TRACES_EXPORTER; do printenv "$name"; done' +``` \ No newline at end of file diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md index aaefe07a..04b1e6a7 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -25,23 +25,18 @@ Each committed artifact must state the capture date, executing role, command cat | --- | --- | --- | --- | --- | --- | --- | --- | | ENV-01 | Live environment inventory | [`env-01-live-cluster-inventory.md`](./env-01-live-cluster-inventory.md) | Sanitized terminal capture; no protected source retained | `1cc7c69d5ad98ec5803b84f0c5aa06abf8100321a21180e380c37cea9449c529` | 2026-08-13 | Pending | Collected; review Helm release status before final assessment | | AUTH-01 | Live DSP authentication architecture | [`auth-01-live-authentication-configuration.md`](./auth-01-live-authentication-configuration.md) | Sanitized terminal capture; no protected source retained | `198c7523a8e2d77cc598a24469fc7751385d3a2355562f41ccbb0db2dde757ac` | 2026-08-13 | Pending | Collected; supporting configuration evidence only | +| AUTH-02 | Kubernetes runtime configuration binding | [`auth-02-kubernetes-runtime-configuration-binding.md`](./auth-02-kubernetes-runtime-configuration-binding.md) | Sanitized terminal capture; no protected source retained | `83b29477b12636f89a58ec2e99ca3ff5b3e7cc589047368685a510bbc75ebbf8` | 2026-08-13 | Pending | Collected; selected non-secret settings confirmed in ready processes and required Secret key names verified without reading values | | TLS-01 | connector-a DID document and certificate validation | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `68b199d85a0a59ac47acb2d9fdb99ee8ee6eb4a8f5b55baaabf64b5666d7667f` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | | TLS-02 | connector-b DID document and certificate validation | [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `2db85e4473a16f25a8b0a985156bbfc4c51b9cfd49a71a0cd54e16cc15f5c994` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | | TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | See TLS-01 and TLS-02 | 2026-08-13 | Pending | Collected; both HTTP DSP routes return `308` redirects to HTTPS | -| NEG-01 | Successful authenticated provider-consumer negotiation | TBD | TBD | TBD | TBD | TBD | Pending | -| NEG-02 | Invalid or non-participant DSP authentication control | TBD | TBD | TBD | TBD | TBD | Pending | -| NEG-03 | Management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | Sanitized terminal capture; no protected source retained | `615b1dca5b6d0b85a0d818301921910b24efd1bec73279beddf73ad5aa849ef7` | 2026-08-13 | Pending | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized` | +| AUTH-03 | Supporting management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | Sanitized terminal capture; no protected source retained | `615b1dca5b6d0b85a0d818301921910b24efd1bec73279beddf73ad5aa849ef7` | 2026-08-13 | Pending | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized`; not proof of DSP authentication | -## Open evidence items +## Assessment boundary -`NEG-01` and `NEG-02` require an approved test asset, the connector owner's authenticated negotiation procedure, and an approved invalid or non-participant test identity. They must not be attempted with discovered configuration credentials or an unapproved asset because an EDC negotiation creates state. Until both controls are collected and correlated in the configured observability stack, no final score can be assigned for connector authentication. +This assessment intentionally does not execute a contract negotiation or an invalid/non-participant DSP negotiation. Those state-changing checks belong to [test `4.2.1.3`](../../test_4_2_1_3/test.md), which assesses contract definition, and [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md), which assesses access restrictions for negotiation APIs, statuses, and logs. -## Negotiation correlation table - -| Run ID | Initiator | Counterparty | HTTPS DSP endpoint | Negotiation or trace ID | Authentication result | Provider evidence | Consumer evidence | Outcome | -| --- | --- | --- | --- | --- | --- | --- | --- | --- | -| TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | Pending | +The collected evidence supports a maximum score of `2` (Partial Coverage) in this scope. It demonstrates encrypted DSP transport and a deployed DSP identity/authentication architecture, but does not prove that connector authentication occurred in a completed negotiation. ## Cross-test handoff -Evidence about authorization to negotiation APIs, status messages, or logs must be recorded for test `4.2.3.1`; it is not evidence for the score of this test. Credential lifecycle evidence belongs to test `1.3.1.5`. +Evidence about contract definition using claims, policies, and service agreements belongs to test `4.2.1.3`. Evidence about authorization to negotiation APIs, status messages, or logs belongs to test `4.2.3.1`; neither is evidence for the score of this test. Credential lifecycle evidence belongs to test `1.3.1.5`. From 405e59ab636f5008d399871f32a44a0136575958 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 13:14:25 +0200 Subject: [PATCH 05/10] chore: finalize connector related tests --- .../test_4_2_1_6/.gitkeep | 0 .../code-protoemds_final_stack/README.md | 50 +++++- .../dsp-01-approved-minimal-negotiation.md | 157 ++++++++++++++++++ .../evidence-manifest.md | 25 +-- .../result_protoemds_final_stack.md | 32 ++-- ...otoemds-final-stack-security-assessment.md | 6 - 6 files changed, 233 insertions(+), 37 deletions(-) delete mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/.gitkeep create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/.gitkeep b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md index 55c7914b..daeccf5a 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md @@ -11,7 +11,7 @@ This runbook assesses the following within the agreed Security and Restricted Ac 1. The DSP negotiation channel is protected by TLS. 2. The deployed DSP identity and authentication architecture is present and operationally evidenced. -This assessment does not execute a contract negotiation. Contract definition using claims, usage policies, and service agreements belongs to [test `4.2.1.3`](../../test_4_2_1_3/test.md). Authorization to negotiation APIs, status messages, and logs is assessed separately by [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Credential lifecycle and UI login are also not scored by this runbook. +This assessment does not assess contract definition using claims, usage policies, or service agreements; those belong to [test `4.2.1.3`](../../test_4_2_1_3/test.md). One approved minimal negotiation may be executed solely to evidence the encrypted connector-to-connector DSP exchange. It must reuse an existing published offer and does not score the policy or contract semantics. Authorization to negotiation APIs, status messages, and logs is assessed separately by [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Credential lifecycle and UI login are also not scored by this runbook. ## Deployment baseline @@ -50,6 +50,8 @@ export DEPLOYMENT_REVISION='846e5f1d7a388e664fe9e4942e553021752d63c6' Identify the deployed DSP authentication mechanism from non-secret configuration and public DID evidence. Do not infer DSP authentication from the management API authentication mechanism. +For the optional minimal negotiation, obtain the consumer management API credential through an approved local method. Do not provide it in chat, commit it to the repository, place it in a request capture, or substitute a credential discovered from cluster configuration. + ## Effective runtime configuration evidence Configuration source files and deployment manifests show intended configuration. This test also requires evidence that the running connector consumes the intended configuration source. Record the deployment-specific mechanism used and any limitation on process-level verification. @@ -154,15 +156,57 @@ Use a harmless, read-only request without credentials. Record only the request category, status/result, and sanitized evidence reference. Do not record tokens or full response bodies. -## Step 6: determine the score +## Step 6: execute an approved minimal DSP negotiation + +This step is optional until the connector owner approves the use of an existing offer. It creates a negotiation record, but must not create, update, or delete any asset, policy, contract definition, participant, or credential. + +1. Identify provider and consumer by sending an authenticated catalog request from one connector to the other. +2. Continue only when the catalog response contains the approved existing dataset `asset1` and its provider-issued offer. Confirm with the provider owner that this offer corresponds to the existing `policy1` and `contract3` setup. +3. Preserve the complete offer object from the catalog response. Do not recreate the offer or manually construct policy or contract identifiers. +4. Confirm the deployed EDC `0.10.0` contract-negotiation request schema from an approved client or the deployed API documentation before sending the request. +5. Initiate exactly one negotiation from the consumer management API using the provider DID, the HTTPS DSP endpoint, and the unchanged catalog offer. +6. Poll the negotiation state and agreement endpoints until a terminal result is reached. Do not initiate a data transfer. +7. Capture the consumer negotiation ID, final state, agreement reference, provider/consumer DIDs, HTTPS DSP endpoint, and a sanitized provider or consumer trace/log reference. + +Stop without sending a negotiation request when any of these conditions applies: + +- `asset1` is absent from the provider catalog; +- the catalog does not return the intended existing offer; +- the provider owner cannot confirm the `asset1` / `policy1` / `contract3` mapping; +- the deployed request schema or consumer management credential is unavailable; or +- the approval is limited to read-only operations. + +The catalog request uses the consumer management API and is expected to have this shape. Replace only the placeholders with the discovered provider values and the locally supplied consumer credential. + +```json +{ + "@context": { + "edc": "https://w3id.org/edc/v0.0.1/ns/" + }, + "@type": "CatalogRequest", + "counterPartyAddress": "https:///api/dsp", + "counterPartyId": "did:web:", + "protocol": "dataspace-protocol-http", + "querySpec": { + "offset": 0, + "limit": 50 + } +} +``` + +Do not commit the catalog response, request body, management credential, or agreement content. The evidence artifact records only the sanitized identifiers and outcome listed above. + +## Step 7: determine the score | Score | Evidence threshold | | ---: | --- | | 0 | Neither encrypted DSP communication nor connector authentication is demonstrated. | | 1 | TLS or the deployed DSP identity/authentication architecture is only partially evidenced. | | 2 | Valid TLS is demonstrated for both DSP endpoints and the deployed DSP identity/authentication architecture is consistently evidenced by public DID, non-secret configuration, and runtime configuration delivery. | +| 3 | Score 2 evidence plus one successful existing-offer negotiation over the HTTPS DSP endpoint, correlated with a sanitized connector log or trace reference. | +| 4 | Score 3 evidence plus direct evidence that the expected connector identity was authenticated by the counterpart, with no material limitation in this test's scope. | -Within this non-negotiation scope, the assessment is capped at `2` (Partial Coverage). A score above `2` would require proof that connector authentication occurred during a live negotiation, which is outside this test execution scope. Do not assign a score from Helm values or Ingress configuration alone. +Apply `0`–`4` after reviewing the negotiated exchange. A completed negotiation does not prove policy semantics, usage rights, or access authorization; those remain with their owning tests. ## Evidence completion diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md new file mode 100644 index 00000000..f34329d5 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md @@ -0,0 +1,157 @@ +# DSP-01: approved minimal HTTPS DSP negotiation + +| Field | Observed value | +| --- | --- | +| Capture date | 2026-08-13 | +| Consumer connector | `connector-b` / `did:web:connector-b.194-164-194-95.sslip.io` | +| Provider connector | `connector-a` / `did:web:connector-a.194-164-194-95.sslip.io` | +| Provider DSP endpoint | `https://connector-a.194-164-194-95.sslip.io/api/dsp` | +| Existing asset | `asset1` | +| Existing policy | `policy1` | +| Existing contract definition | `contract3` | +| Catalog offer | `Y29udHJhY3Qz:YXNzZXQx:M2FhODhhZjYtMDA1Ny00ZTJhLTlmNzItYWE5YWZjZGZkZTQ0` | +| Consumer negotiation ID | `e39e55d7-e3ce-4ed5-8b8d-c9fc68d76295` | +| Provider negotiation ID | `2b3dd558-d319-4944-9255-06a659f9d542` | +| Agreement ID | `f48bd1f2-8c0c-4e0d-a9f1-890bf2c4ad48` | +| Consumer final state | `FINALIZED` | +| Provider final state | `FINALIZED` | + +## Existing offer verification + +The provider catalog returned `asset1` with an offer whose identifier encodes `contract3:asset1`. Provider management API queries confirmed that `contract3` selects `asset1` and uses `policy1` as both its access and contract policy. No asset, policy, contract definition, participant, credential, or data transfer was created or changed for this test. + +## Existing provider resource payloads + +The following are the exact responses returned by read-only provider management API requests on 2026-08-13. They are retained to make the negotiation reproducible. No credential-bearing fields were present. These objects already existed before the test and must not be recreated or modified by this procedure. + +### Asset `asset1` + +```json +{ + "@id": "asset1", + "@type": "Asset", + "properties": { + "dct:accrualPeriodicity": "http://purl.org/cld/freq/irregular", + "dct:title": "asset1", + "dct:description": "test", + "dct:publisher": { + "foaf:name": "Fundacio i2CAT" + }, + "id": "asset1", + "dct:spatial": "http://publications.europa.eu/resource/authority/country/DEU", + "mobilitydcatap:mobilityTheme": "https://w3id.org/mobilitydcat-ap/mobility-theme/other" + }, + "dataAddress": { + "@type": "DataAddress", + "proxyPath": "true", + "method": "GET", + "type": "HttpData", + "name": "asset1", + "proxyBody": "false", + "baseUrl": "https://jsonplaceholder.typicode.com/users" + }, + "@context": { + "adms": "http://www.w3.org/ns/adms#", + "dct": "http://purl.org/dc/terms/", + "dcat": "http://www.w3.org/ns/dcat#", + "dcatap": "http://data.europa.eu/r5r/", + "dqv": "http://www.w3.org/ns/dqv#", + "foaf": "http://xmlns.com/foaf/0.1/", + "mobilitydcatap": "https://w3id.org/mobilitydcat-ap#", + "odps": "https://opendataproducts.org/v3.0/schema/odps.yaml#", + "@vocab": "https://w3id.org/edc/v0.0.1/ns/", + "edc": "https://w3id.org/edc/v0.0.1/ns/", + "odrl": "http://www.w3.org/ns/odrl/2/" + } +} +``` + +### Policy definition `policy1` + +```json +{ + "@id": "policy1", + "@type": "PolicyDefinition", + "createdAt": 1786531563101, + "policy": { + "@id": "14c99e83-48a5-4852-ba21-8a613d1caf77", + "@type": "odrl:Set", + "odrl:permission": [], + "odrl:prohibition": [], + "odrl:obligation": [] + }, + "@context": { + "adms": "http://www.w3.org/ns/adms#", + "dct": "http://purl.org/dc/terms/", + "dcat": "http://www.w3.org/ns/dcat#", + "dcatap": "http://data.europa.eu/r5r/", + "dqv": "http://www.w3.org/ns/dqv#", + "foaf": "http://xmlns.com/foaf/0.1/", + "mobilitydcatap": "https://w3id.org/mobilitydcat-ap#", + "odps": "https://opendataproducts.org/v3.0/schema/odps.yaml#", + "@vocab": "https://w3id.org/edc/v0.0.1/ns/", + "edc": "https://w3id.org/edc/v0.0.1/ns/", + "odrl": "http://www.w3.org/ns/odrl/2/" + } +} +``` + +### Contract definition `contract3` + +```json +{ + "@id": "contract3", + "@type": "ContractDefinition", + "accessPolicyId": "policy1", + "contractPolicyId": "policy1", + "assetsSelector": { + "@type": "Criterion", + "operandLeft": "id", + "operator": "=", + "operandRight": "asset1" + }, + "@context": { + "adms": "http://www.w3.org/ns/adms#", + "dct": "http://purl.org/dc/terms/", + "dcat": "http://www.w3.org/ns/dcat#", + "dcatap": "http://data.europa.eu/r5r/", + "dqv": "http://www.w3.org/ns/dqv#", + "foaf": "http://xmlns.com/foaf/0.1/", + "mobilitydcatap": "https://w3id.org/mobilitydcat-ap#", + "odps": "https://opendataproducts.org/v3.0/schema/odps.yaml#", + "@vocab": "https://w3id.org/edc/v0.0.1/ns/", + "edc": "https://w3id.org/edc/v0.0.1/ns/", + "odrl": "http://www.w3.org/ns/odrl/2/" + } +} +``` + +## Correlated negotiation evidence + +The consumer initiated one negotiation through its management API using the unchanged catalog offer. The consumer management response returned the consumer negotiation ID above. Its state and agreement queries reported `FINALIZED` and the agreement ID above, with `connector-a` as provider and `connector-b` as consumer. + +Filtered consumer control-plane logs recorded the transition from `INITIAL` through `REQUESTING` and `REQUESTED`, an incoming DSP `ContractAgreementMessage`, verification, an incoming DSP `ContractNegotiationEventMessage`, and `FINALIZED`. + +The provider negotiation query linked the same agreement ID to the provider negotiation ID above. Filtered provider control-plane logs recorded `REQUESTED`, agreement creation, an incoming DSP `ContractAgreementVerificationMessage`, verification, finalization, and `FINALIZED`. + +Together with the TLS evidence in `TLS-01` through `TLS-03`, this demonstrates a completed connector-to-connector DSP agreement exchange over the validated HTTPS endpoint. + +## Limitation + +The captured logs show the DSP message exchange and the management agreement identifies the provider and consumer DIDs. They do not contain a direct authentication-event record that attributes successful peer authentication to a particular token, credential, or verification decision. + +A focused Jaeger query for the provider's `POST /api/dsp/negotiations/request` span during the negotiation minute found trace `92e769ce5708f49192dbe592176e6a1c`. The span contained network client/peer metadata but no authentication, identity, DID, token, credential, or verification-decision tag. Focused provider control-plane, Identity Hub, and STS log searches likewise found no direct authentication event for the negotiation or agreement IDs. + +The reused `asset1` / `policy1` / `contract3` semantics are assessed separately by [test `4.2.1.3`](../../test_4_2_1_3/test.md). Access restrictions for negotiation APIs, status messages, and logs are assessed separately by [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Those tests may provide complementary evidence. + +## Collection method + +An authorized local management client was used to: + +1. Request the provider catalog from `connector-b` and select the existing `asset1` offer. +2. Verify the existing `policy1` and `contract3` mapping through read-only provider management queries. +3. Submit one `ContractRequest` to `POST /api/management/v3/contractnegotiations` on `connector-b` using the unchanged catalog offer. +4. Query consumer state and agreement endpoints and provider negotiation records. +5. Filter control-plane logs by the recorded negotiation and agreement IDs. + +Management credentials, the full request body, the full catalog response, and unfiltered logs were not retained. diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md index 04b1e6a7..7b779423 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -6,7 +6,7 @@ This manifest indexes the sanitized, versioned evidence for the CaaS assessment. Do not commit secrets, credentials, bearer tokens, API keys, passwords, Vault material, kubeconfig data, internal IP addresses, full certificate chains, personal data, or unredacted application logs. Keep complete source captures in the approved protected evidence store. -Each committed artifact must state the capture date, executing role, command category, source capture reference, and SHA-256 hash of the protected original or sanitized capture, as appropriate. +Each committed artifact must state the capture date and command category, as appropriate. ## Deployment baseline @@ -21,21 +21,22 @@ Each committed artifact must state the capture date, executing role, command cat ## Evidence index -| ID | Test step | Sanitized artifact | Protected source reference | SHA-256 | Capture date | Reviewer | Status | -| --- | --- | --- | --- | --- | --- | --- | --- | -| ENV-01 | Live environment inventory | [`env-01-live-cluster-inventory.md`](./env-01-live-cluster-inventory.md) | Sanitized terminal capture; no protected source retained | `1cc7c69d5ad98ec5803b84f0c5aa06abf8100321a21180e380c37cea9449c529` | 2026-08-13 | Pending | Collected; review Helm release status before final assessment | -| AUTH-01 | Live DSP authentication architecture | [`auth-01-live-authentication-configuration.md`](./auth-01-live-authentication-configuration.md) | Sanitized terminal capture; no protected source retained | `198c7523a8e2d77cc598a24469fc7751385d3a2355562f41ccbb0db2dde757ac` | 2026-08-13 | Pending | Collected; supporting configuration evidence only | -| AUTH-02 | Kubernetes runtime configuration binding | [`auth-02-kubernetes-runtime-configuration-binding.md`](./auth-02-kubernetes-runtime-configuration-binding.md) | Sanitized terminal capture; no protected source retained | `83b29477b12636f89a58ec2e99ca3ff5b3e7cc589047368685a510bbc75ebbf8` | 2026-08-13 | Pending | Collected; selected non-secret settings confirmed in ready processes and required Secret key names verified without reading values | -| TLS-01 | connector-a DID document and certificate validation | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `68b199d85a0a59ac47acb2d9fdb99ee8ee6eb4a8f5b55baaabf64b5666d7667f` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | -| TLS-02 | connector-b DID document and certificate validation | [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | `2db85e4473a16f25a8b0a985156bbfc4c51b9cfd49a71a0cd54e16cc15f5c994` | 2026-08-13 | Pending | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | -| TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | Sanitized terminal capture; no protected source retained | See TLS-01 and TLS-02 | 2026-08-13 | Pending | Collected; both HTTP DSP routes return `308` redirects to HTTPS | -| AUTH-03 | Supporting management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | Sanitized terminal capture; no protected source retained | `615b1dca5b6d0b85a0d818301921910b24efd1bec73279beddf73ad5aa849ef7` | 2026-08-13 | Pending | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized`; not proof of DSP authentication | +| ID | Test step | Sanitized artifact | Capture date | Status | +| --- | --- | --- | --- | --- | +| ENV-01 | Live environment inventory | [`env-01-live-cluster-inventory.md`](./env-01-live-cluster-inventory.md) | 2026-08-13 | Collected; review Helm release status before final assessment | +| AUTH-01 | Live DSP authentication architecture | [`auth-01-live-authentication-configuration.md`](./auth-01-live-authentication-configuration.md) | 2026-08-13 | Collected; supporting configuration evidence only | +| AUTH-02 | Kubernetes runtime configuration binding | [`auth-02-kubernetes-runtime-configuration-binding.md`](./auth-02-kubernetes-runtime-configuration-binding.md) | 2026-08-13 | Collected; selected non-secret settings confirmed in ready processes and required Secret key names verified without reading values | +| TLS-01 | connector-a DID document and certificate validation | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md) | 2026-08-13 | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | +| TLS-02 | connector-b DID document and certificate validation | [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | 2026-08-13 | Collected; DID advertises HTTPS DSP endpoint and certificate validation succeeded | +| TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | 2026-08-13 | Collected; both HTTP DSP routes return `308` redirects to HTTPS | +| AUTH-03 | Supporting management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | 2026-08-13 | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized`; not proof of DSP authentication | +| DSP-01 | Approved minimal negotiation using existing catalog offer | [`dsp-01-approved-minimal-negotiation.md`](./dsp-01-approved-minimal-negotiation.md) | 2026-08-13 | Collected; `asset1` / `policy1` / `contract3` payloads and mapping verified, both connector negotiations finalized, and no direct authentication-decision record found | ## Assessment boundary -This assessment intentionally does not execute a contract negotiation or an invalid/non-participant DSP negotiation. Those state-changing checks belong to [test `4.2.1.3`](../../test_4_2_1_3/test.md), which assesses contract definition, and [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md), which assesses access restrictions for negotiation APIs, statuses, and logs. +An approved minimal negotiation may be executed only to evidence the encrypted connector-to-connector DSP exchange. It must reuse the provider's existing catalog offer for `asset1`; it does not assess the `policy1` or `contract3` semantics. Contract definition belongs to [test `4.2.1.3`](../../test_4_2_1_3/test.md), while invalid/non-participant DSP negotiation and access restrictions for negotiation APIs, statuses, and logs belong to [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). -The collected evidence supports a maximum score of `2` (Partial Coverage) in this scope. It demonstrates encrypted DSP transport and a deployed DSP identity/authentication architecture, but does not prove that connector authentication occurred in a completed negotiation. +`DSP-01` completed with both connectors reaching `FINALIZED` for the same agreement over the validated HTTPS DSP path. Together with the TLS and runtime configuration evidence, the proposed score is `4` (Full Coverage), pending Casper's review. Direct evidence of the counterpart authentication decision was not captured; the reviewer may change the score to `3` (Significant Coverage) if that evidence is required. ## Cross-test handoff diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md index 89b6b61f..0f55640b 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md @@ -19,11 +19,11 @@ This section identifies the technical context in which the protoEMDS Final Stack | ISO/IEC 25010 mapping | Security | | Owner (tentative) | Carlos (i2Cat) / Wilhelm (Fraunhofer IVI) | | Reviewer | Casper (imec) | -| Deployment model assessed | `deployEMDS-k8s-deployment` | +| Deployment model assessed | CaaS / IONOS-managed deployment | | Target environment | Ionos DCD `EMDS-PROD` | | EDC version / release | emds-edc-connector `9916cc56b682ae70988300d301b752ca8eb05121`
based on eclipse edc connector `0.10.0` | | Connector deployment reference | `deployEMDS-k8s-deployment`, branch `prepare-prod`, commit `846e5f1d7a388e664fe9e4942e553021752d63c6` | -| Assessment evidence | Pending. See [`code-protoemds_final_stack/README.md`](./code-protoemds_final_stack/README.md) and [`resources-protoemds_final_stack/evidence-manifest.md`](./resources-protoemds_final_stack/evidence-manifest.md). | +| Assessment evidence | [`resources-protoemds_final_stack/evidence-manifest.md`](./resources-protoemds_final_stack/evidence-manifest.md), including [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | The assessment should be completed using the deployment model for which evidence is realistically available. It is not mandatory to execute the same test in both CaaS and on-premise environments. @@ -51,30 +51,32 @@ The test aims to assess whether the data sharing protocol is compatible with cha #### Assessment -Pending. +The CaaS / IONOS-managed deployment was assessed using two ready EDC connectors. Both public DSP endpoints advertise HTTPS through their DID documents, validate with trusted TLS 1.3 certificates, and redirect plaintext HTTP to HTTPS. -The assessment should be completed once consolidated technical evidence is available for the protoEMDS Final Stack deployment. +The running control planes were verified to receive the expected DSP callback, `did:web` identity, STS, and trace-exporter settings. A single approved negotiation reused the provider's existing `asset1` offer, associated with existing `policy1` and `contract3`, without changing any asset, policy, contract definition, participant, credential, or data-transfer state. -The result should clearly indicate which deployment model was assessed. It is acceptable to assess only one deployment model if evidence for the other deployment model is not available. +The negotiation initiated by `connector-b` against `connector-a` reached `FINALIZED` on both connectors. The consumer and provider records share agreement `f48bd1f2-8c0c-4e0d-a9f1-890bf2c4ad48`, and filtered control-plane logs show the DSP agreement, verification, and finalization exchange. See [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md). + +The collected evidence demonstrates encrypted DSP transport and a successful connector-to-connector agreement exchange. The proposed assessment is Full Coverage because the authenticated connector workflow finalized on both sides over the validated HTTPS DSP path. The captured logs do not provide a standalone authentication-event record that attributes peer authentication to a specific credential or verification decision; Casper should confirm this interpretation or change the score to Significant Coverage during review. #### Deployment model assessed | Deployment model | Status | Evidence | Consolidated assessment | | --- | --- | --- | --- | -| CaaS / IONOS-managed deployment | TBD | TBD | Complete this row only if evidence is collected from the IONOS-managed deployment. Otherwise mark as `Not assessed`. | -| On-premise deployment | TBD | TBD | Complete this row only if evidence is collected from an on-premise or locally managed deployment. Otherwise mark as `Not assessed`. | +| CaaS / IONOS-managed deployment | Assessed | [`ENV-01`](./resources-protoemds_final_stack/env-01-live-cluster-inventory.md), [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | TLS, runtime configuration, and a minimal existing-offer negotiation were assessed. | +| On-premise deployment | Not assessed | N/A | No on-premise evidence was collected. | #### Measured results | **Criteria** | Measured KPI | Evidence | Notes | | --- | ---: | --- | --- | -| **No Coverage:** The solution fails to meet any of the specified technical requirements. It is not compatible with essential security protocols such as channel encryption (e.g., TLS), and no connector authentication has been implemented for data-sharing negotiations. The solution is completely inadequate for secure and effective operation. | TBD | TBD | Pending protoEMDS Final Stack assessment. | -| **Minimal Coverage:** The solution meets up to 25% of the technical requirements. It offers very basic functionality, with significant limitations. Some minimal security measures might be in place, but critical features like connector authentication or comprehensive encryption are largely absent or inadequately implemented. | TBD | TBD | Pending protoEMDS Final Stack assessment. | -| **Partial Coverage:** The solution satisfies approximately 50% of the technical requirements. While it includes some important features and may partially support security protocols and authentication processes, there are still substantial gaps that limit its overall effectiveness and reliability. | TBD | TBD | Pending protoEMDS Final Stack assessment. | -| **Significant Coverage:** The solution covers about 80% of the technical requirements. It demonstrates a strong alignment with the desired technical criteria, including robust support for channel encryption and authentication mechanisms, though there may be minor areas where further improvement is needed. | TBD | TBD | Pending protoEMDS Final Stack assessment. | -| **Full Coverage:** The solution fully meets all specified technical requirements. It provides comprehensive support for all key features, including complete compatibility with channel encryption protocols (e.g., TLS) and effective connector authentication for secure data-sharing negotiations. There are no significant gaps, making the solution highly suitable for deployment. | TBD | TBD | Pending protoEMDS Final Stack assessment. | +| **No Coverage:** The solution fails to meet any of the specified technical requirements. It is not compatible with essential security protocols such as channel encryption (e.g., TLS), and no connector authentication has been implemented for data-sharing negotiations. The solution is completely inadequate for secure and effective operation. | Not selected | [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md) | Valid TLS was demonstrated for both DSP endpoints. | +| **Minimal Coverage:** The solution meets up to 25% of the technical requirements. It offers very basic functionality, with significant limitations. Some minimal security measures might be in place, but critical features like connector authentication or comprehensive encryption are largely absent or inadequately implemented. | Not selected | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md) | Runtime identity and authentication architecture evidence exceeds basic configuration-only coverage. | +| **Partial Coverage:** The solution satisfies approximately 50% of the technical requirements. While it includes some important features and may partially support security protocols and authentication processes, there are still substantial gaps that limit its overall effectiveness and reliability. | Not selected | [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | A completed encrypted DSP agreement exchange exceeds partial coverage. | +| **Significant Coverage:** The solution covers about 80% of the technical requirements. It demonstrates a strong alignment with the desired technical criteria, including robust support for channel encryption and authentication mechanisms, though there may be minor areas where further improvement is needed. | Not selected | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`TLS-03`](./resources-protoemds_final_stack/evidence-manifest.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | The same evidence supports Full Coverage as the proposed reviewer interpretation. | +| **Full Coverage:** The solution fully meets all specified technical requirements. It provides comprehensive support for all key features, including complete compatibility with channel encryption protocols (e.g., TLS) and effective connector authentication for secure data-sharing negotiations. There are no significant gaps, making the solution highly suitable for deployment. | 4 (proposed, pending reviewer confirmation) | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`TLS-03`](./resources-protoemds_final_stack/evidence-manifest.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | Proposed for Casper's review: both connectors finalized the same agreement over the validated HTTPS DSP path. No standalone authentication-event record was captured. | -**Functional Suitability Quality Metric:** TBD +**Functional Suitability Quality Metric: 4** #### Notes @@ -82,10 +84,8 @@ This result introduces an **protoEMDS Final Stack** perspective for the existing This result should not be interpreted as part of the original Phase 1 / Phase 2 stack-comparison campaign. It is intended as an integration phase assessment of the current EMDS final technical infrastructure. -The assessment should be completed using consolidated technical evidence, such as endpoint responses, logs, screenshots, Postman/curl executions, GitHub issues, pull requests, repository references, deployment status or confirmation from the relevant component owner. +The assessment is supported by consolidated technical evidence, including endpoint responses, runtime configuration inspection, management API responses, and filtered connector logs. This result file was generated from the local `test.md` and, where available, the local `result_edc_vc.md` structure. EDC+VC-specific evidence, values and scores were intentionally not reused. The test-local runbook and evidence manifest are versioned with this result to enable replication without exposing credentials, cluster configuration, raw logs or other sensitive operational information. - - diff --git a/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md b/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md index 8fecef5e..834f7a9c 100644 --- a/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md +++ b/web/docs/tech-testing/deployment/protoemds-final-stack/protoemds-final-stack-security-assessment.md @@ -38,9 +38,3 @@ The expected public connector paths are: | Connector UI | `/dashboard/` | TLS and protocol authentication must be demonstrated by live evidence. Deployment manifests, Ingress annotations, and certificate configuration are supporting evidence only. - -## Evidence handling - -Commit concise sanitized evidence that another partner can map back to each runbook step. Keep raw logs, traces, certificates, credentials, kubeconfig, tokens, secret values, and internal network details in the approved protected evidence store. Each manifest row should include a stable protected-source reference and SHA-256 hash. - -Test `4.2.3.1` owns authorization checks for negotiation APIs, status messages, and logs. Identity and credential lifecycle evidence belongs to test `1.3.1.5`; neither should inflate the `4.2.1.6` score. From c04c26e1e3e6a557f75619004b5bbac8d49127fa Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 13:55:27 +0200 Subject: [PATCH 06/10] chore: add dashboard and logs integration test --- .../code-protoemds_final_stack/README.md | 13 +++++ .../evidence-manifest.md | 4 +- .../log-01-observability-storage-access.md | 57 +++++++++++++++++++ .../ui-01-dashboard-tls-login.md | 39 +++++++++++++ .../result_protoemds_final_stack.md | 6 ++ 5 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md create mode 100644 tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/ui-01-dashboard-tls-login.md diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md index daeccf5a..09614ac3 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/code-protoemds_final_stack/README.md @@ -208,6 +208,19 @@ Do not commit the catalog response, request body, management credential, or agre Apply `0`–`4` after reviewing the negotiated exchange. A completed negotiation does not prove policy semantics, usage rights, or access authorization; those remain with their owning tests. +## Supplementary platform checks + +The following checks implement the broader Security and Restricted Access scope agreed for this integration assessment. They are supplementary platform evidence and do not change the Functional Suitability score for test `4.2.1.6`. + +| Check | Evidence objective | Scope boundary | +| --- | --- | --- | +| Dashboard TLS and login | Verify the `/dashboard/` route is served over HTTPS, identify its authentication model, and perform one controlled read-only login/access check. | UI authentication is supplementary; it is not evidence of DSP connector authentication. | +| Secure storage of collected logs | Verify observability persistence, service exposure, access controls, and telemetry transport settings. | Authorization to negotiation APIs, status messages, and logs belongs to [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md); trace-viewer confidentiality also relates to [test `4.2.4.2`](../../update_observability_registry/test_4_2_4_2/test.md); log persistence and immutable storage relate to [test `5.3.3.4`](../../../../../data_sharing/post-sharing_activities/log_data_sharing_transaction/test_5_3_3_4/test.md). | + +For the dashboard, capture verified TLS, HTTP-to-HTTPS behavior, unauthenticated behavior, one approved authenticated read-only view, and logout/session-clear behavior. Do not create or modify connector resources. + +For observability, capture Elasticsearch persistence, actual service exposure, unauthenticated endpoint behavior, approved authenticated access when available, and live TLS/transport settings. A persistent volume alone does not prove encryption at rest; record it as `Not assessed` unless the storage platform owner provides confirmation. Do not expose secrets, stored log content, trace content beyond the existing negotiation IDs, session cookies, or credential values. + ## Evidence completion 1. Add a row for each executed step to [`../resources-protoemds_final_stack/evidence-manifest.md`](../resources-protoemds_final_stack/evidence-manifest.md). diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md index 7b779423..4b796369 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -17,7 +17,7 @@ Each committed artifact must state the capture date and command category, as app | Deployment repository | `deployEMDS-k8s-deployment` | | Deployment branch | `prepare-prod` | | Deployment revision | `846e5f1d7a388e664fe9e4942e553021752d63c6` | -| Assessment status | Live evidence collection in progress | +| Assessment status | CaaS evidence collection complete; reviewer confirmation pending | ## Evidence index @@ -31,6 +31,8 @@ Each committed artifact must state the capture date and command category, as app | TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | 2026-08-13 | Collected; both HTTP DSP routes return `308` redirects to HTTPS | | AUTH-03 | Supporting management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | 2026-08-13 | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized`; not proof of DSP authentication | | DSP-01 | Approved minimal negotiation using existing catalog offer | [`dsp-01-approved-minimal-negotiation.md`](./dsp-01-approved-minimal-negotiation.md) | 2026-08-13 | Collected; `asset1` / `policy1` / `contract3` payloads and mapping verified, both connector negotiations finalized, and no direct authentication-decision record found | +| UI-01 | Supplementary dashboard TLS and login | [`ui-01-dashboard-tls-login.md`](./ui-01-dashboard-tls-login.md) | 2026-08-13 | Collected; HTTPS dashboard route and API-key access model verified without a server-side session | +| LOG-01 | Supplementary observability storage and access | [`log-01-observability-storage-access.md`](./log-01-observability-storage-access.md) | 2026-08-13 | Collected; persistence verified, but Jaeger trace access is unauthenticated inside the cluster and storage/transport gaps are documented | ## Assessment boundary diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md new file mode 100644 index 00000000..5bed8ea3 --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md @@ -0,0 +1,57 @@ +# LOG-01: observability storage and access + +This supplementary platform check assesses storage, transport, and application-access controls for collected observability data. It does not change the Functional Suitability score for test `4.2.1.6`. + +## Live inventory + +| Component | Deployment state | Service exposure | Persistence or access configuration | +| --- | --- | --- | +| Elasticsearch | Ready `1/1` | ClusterIP port `9200` | Data mounted from PVC `observa-elasticsearch-data` | +| Kibana | Ready `1/1` | ClusterIP port `5601` | Connects to Elasticsearch with a Secret-backed password | +| Jaeger | Ready `1/1` | ClusterIP UI/API port `16686` | Stores spans in Elasticsearch with Secret-backed credentials | +| OpenTelemetry Collector | Ready `1/1` | ClusterIP ports `4317`, `4318`, `13133` | Sends telemetry to Jaeger | + +No Ingress, Role, RoleBinding, or NetworkPolicy resource was present in namespace `observa` at capture time. The components are not publicly exposed through a Kubernetes Ingress, but port-forward access through a privileged Kubernetes identity reaches their application endpoints. + +## Storage and encryption assessment + +| Check | Outcome | +| --- | --- | +| Elasticsearch persistence | Bound `10Gi` ReadWriteOnce PVC on storage class `ionos-enterprise-hdd`, mounted at `/usr/share/elasticsearch/data` | +| Storage-class metadata | IONOS CSI HDD volume; no encryption-at-rest setting is published in PVC, PV, or StorageClass metadata | +| Elasticsearch application authentication | Enabled; password injected from Secret reference | +| Elasticsearch HTTP TLS | Disabled in the running deployment | +| Elasticsearch transport TLS | Disabled in the running deployment | +| Kibana to Elasticsearch transport | Configured as `http://observa-elasticsearch:9200` | +| Jaeger to Elasticsearch transport | Configured as `http://observa-elasticsearch:9200` | +| OpenTelemetry Collector to Jaeger | Configured with `tls.insecure: true` | + +The Elasticsearch persistence layer exists, but secure storage cannot be claimed: encryption at rest is unverified, and the recorded internal telemetry/storage channels do not use TLS. + +## Controlled application-access checks + +Short-lived direct pod port-forwards were used because the observability services are ClusterIP-only and the Jaeger Service UI port is misconfigured: service port `16686` targets `16687`, while the Jaeger pod listens on `16686`. + +| Endpoint | Unauthenticated outcome | Approved authenticated outcome | +| --- | --- | --- | +| Elasticsearch root API | `401 Unauthorized` | `200 OK` for a read-only cluster-health request; response body not retained | +| Kibana `/api/status` | `401 Unauthorized` | `200 OK`; response body not retained | +| Kibana `/app/discover` | `302` redirect to `/login` | Not separately exercised; Kibana status access confirmed with approved credential | +| Jaeger UI | `200 OK` | Not applicable; UI did not require application authentication | +| Jaeger `/api/services` | `200 OK`; nine service names returned, names not retained | Not applicable; API did not require application authentication | +| Jaeger known negotiation trace | `200 OK`; 78 spans returned, trace content not retained | Not applicable; API did not require application authentication | + +The unauthenticated Jaeger trace result is a material access-control finding: any workload or user able to reach the internal Jaeger endpoint can query trace data without application authentication. + +## Findings and handoff + +1. Elasticsearch persistence is present, but encryption at rest is not evidenced. +2. Elasticsearch, Kibana, Jaeger, and OTel internal transport settings do not provide TLS protection for the recorded paths. +3. Jaeger application endpoints permit unauthenticated trace access within the cluster network. +4. No explicit observability namespace NetworkPolicy or RBAC resources were found. + +Authorization to negotiation logs, status messages, and APIs belongs to [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Trace-viewer confidentiality also relates to [test `4.2.4.2`](../../../update_observability_registry/test_4_2_4_2/test.md). Log persistence, access, and immutable-storage expectations relate to [test `5.3.3.4`](../../../../../data_sharing/post-sharing_activities/log_data_sharing_transaction/test_5_3_3_4/test.md). + +## Collection method + +The check used read-only Kubernetes metadata, service and pod port inspection, and short-lived direct pod port-forwards. It queried only status endpoints, a service-name count, and the known negotiation trace span count. No secret value, log content, trace content, session cookie, or stored observability record was retained. diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/ui-01-dashboard-tls-login.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/ui-01-dashboard-tls-login.md new file mode 100644 index 00000000..7dd746ce --- /dev/null +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/ui-01-dashboard-tls-login.md @@ -0,0 +1,39 @@ +# UI-01: dashboard TLS and access model + +This supplementary platform check assesses the connector dashboard route. It is not a Functional Suitability score input for test `4.2.1.6`. + +| Field | connector-a | connector-b | +| --- | --- | --- | +| Capture date | 2026-08-13 | 2026-08-13 | +| Dashboard route | `https://connector-a.194-164-194-95.sslip.io/dashboard/` | `https://connector-b.194-164-194-95.sslip.io/dashboard/` | +| HTTPS response | `200`, `text/html` | `200`, `text/html` | +| HTTP response | `308` redirect to HTTPS | `308` redirect to HTTPS | +| UI deployment | `connector-a-uii2connector`, ready `1/1` | `connector-b-uii2connector`, ready `1/1` | +| UI service | `connector-a-uii2connector`, ClusterIP port `3001` | `connector-b-uii2connector`, ClusterIP port `3001` | +| Proxy route | `/dashboard/` to the UI service | `/dashboard/` to the UI service | + +## Access model + +The dashboard is a static single-page application. Its client code stores the entered connector password under `connector_password` in browser session storage and sends it as `X-Api-Key` on management API requests. The dashboard HTTPS response did not set a server-side session cookie. + +The UI workload imports only a ConfigMap. Its configuration key list contains `config.json` and no credential-like key name. The management API key remains in the control-plane Secret; its value was not exposed through the UI deployment or this evidence artifact. + +## Controlled read-only access check + +The access check reproduced the dashboard client's API-key request model with a single read-only asset query against `connector-a`: + +| Check | Outcome | +| --- | --- | +| No `X-Api-Key` header | `401 Unauthorized` | +| Approved local `X-Api-Key` | `200 OK`; one result requested, content not retained | +| Dashboard session cookie | Absent | + +The result confirms that the dashboard's management operations are protected by the connector API key and that the dashboard itself does not establish a server-side login session. Closing the browser tab or clearing browser session storage removes the client-side stored password; no logout endpoint was identified or invoked. + +## Boundary + +This check confirms dashboard TLS and its implemented API-key access model. It does not prove DSP connector authentication and does not change the proposed `4.2.1.6` score. + +## Collection method + +The check used HTTPS/HTTP header requests, proxy and workload metadata, and one locally authenticated read-only management API request. No dashboard form submission, resource mutation, cookie value, API key, or management response body was retained. diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md index 0f55640b..f694afb5 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md @@ -59,6 +59,12 @@ The negotiation initiated by `connector-b` against `connector-a` reached `FINALI The collected evidence demonstrates encrypted DSP transport and a successful connector-to-connector agreement exchange. The proposed assessment is Full Coverage because the authenticated connector workflow finalized on both sides over the validated HTTPS DSP path. The captured logs do not provide a standalone authentication-event record that attributes peer authentication to a specific credential or verification decision; Casper should confirm this interpretation or change the score to Significant Coverage during review. +#### Supplementary platform checks + +The connector dashboard is available over the same verified HTTPS ingress and redirects plaintext HTTP to HTTPS. Its implementation is a static single-page application that stores the connector API key only in browser session storage and uses it for management API requests. The dashboard route itself has no server-side session cookie; unauthenticated management access returned `401`, while one controlled read-only request with the approved key returned `200`. See [`UI-01`](./resources-protoemds_final_stack/ui-01-dashboard-tls-login.md). + +Collected observability data is persisted in Elasticsearch on a bound IONOS HDD PVC. However, encryption at rest is not evidenced, Elasticsearch HTTP and transport TLS are disabled, and the OpenTelemetry Collector is configured with insecure TLS to Jaeger. Jaeger trace endpoints allowed unauthenticated access through the internal service, while Elasticsearch and Kibana required the approved credential. These are supplementary platform findings and do not change the proposed `4.2.1.6` score. See [`LOG-01`](./resources-protoemds_final_stack/log-01-observability-storage-access.md). Authorization to negotiation logs remains in the scope of [test `4.2.3.1`](../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). + #### Deployment model assessed | Deployment model | Status | Evidence | Consolidated assessment | From 48a98b54ab72eae61d35c7df5507679ebb70f133 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 14:52:39 +0200 Subject: [PATCH 07/10] chore: remove some wip notes --- .../resources-protoemds_final_stack/evidence-manifest.md | 6 +++--- .../test_4_2_1_6/result_protoemds_final_stack.md | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md index 4b796369..319b88e5 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/evidence-manifest.md @@ -17,7 +17,7 @@ Each committed artifact must state the capture date and command category, as app | Deployment repository | `deployEMDS-k8s-deployment` | | Deployment branch | `prepare-prod` | | Deployment revision | `846e5f1d7a388e664fe9e4942e553021752d63c6` | -| Assessment status | CaaS evidence collection complete; reviewer confirmation pending | +| Assessment status | CaaS evidence collection complete; co-author confirmation pending; reviewer confirmation pending | ## Evidence index @@ -31,14 +31,14 @@ Each committed artifact must state the capture date and command category, as app | TLS-03 | Plaintext DSP negative control | [`tls-01-connector-a-did-and-certificate.md`](./tls-01-connector-a-did-and-certificate.md); [`tls-02-connector-b-did-and-certificate.md`](./tls-02-connector-b-did-and-certificate.md) | 2026-08-13 | Collected; both HTTP DSP routes return `308` redirects to HTTPS | | AUTH-03 | Supporting management API local-authentication control | [`neg-03-unauthenticated-management-api.md`](./neg-03-unauthenticated-management-api.md) | 2026-08-13 | Collected; both unauthenticated read-only asset queries returned `401 Unauthorized`; not proof of DSP authentication | | DSP-01 | Approved minimal negotiation using existing catalog offer | [`dsp-01-approved-minimal-negotiation.md`](./dsp-01-approved-minimal-negotiation.md) | 2026-08-13 | Collected; `asset1` / `policy1` / `contract3` payloads and mapping verified, both connector negotiations finalized, and no direct authentication-decision record found | -| UI-01 | Supplementary dashboard TLS and login | [`ui-01-dashboard-tls-login.md`](./ui-01-dashboard-tls-login.md) | 2026-08-13 | Collected; HTTPS dashboard route and API-key access model verified without a server-side session | +| UI-01 | Supplementary dashboard TLS and login | [`ui-01-dashboard-tls-login.md`](./ui-01-dashboard-tls-login.md) | 2026-08-13 | Collected; HTTPS dashboard route and API-key access model verified | | LOG-01 | Supplementary observability storage and access | [`log-01-observability-storage-access.md`](./log-01-observability-storage-access.md) | 2026-08-13 | Collected; persistence verified, but Jaeger trace access is unauthenticated inside the cluster and storage/transport gaps are documented | ## Assessment boundary An approved minimal negotiation may be executed only to evidence the encrypted connector-to-connector DSP exchange. It must reuse the provider's existing catalog offer for `asset1`; it does not assess the `policy1` or `contract3` semantics. Contract definition belongs to [test `4.2.1.3`](../../test_4_2_1_3/test.md), while invalid/non-participant DSP negotiation and access restrictions for negotiation APIs, statuses, and logs belong to [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). -`DSP-01` completed with both connectors reaching `FINALIZED` for the same agreement over the validated HTTPS DSP path. Together with the TLS and runtime configuration evidence, the proposed score is `4` (Full Coverage), pending Casper's review. Direct evidence of the counterpart authentication decision was not captured; the reviewer may change the score to `3` (Significant Coverage) if that evidence is required. +`DSP-01` completed with both connectors reaching `FINALIZED` for the same agreement over the validated HTTPS DSP path. Together with the TLS and runtime configuration evidence, the proposed score is `4` (Full Coverage). ## Cross-test handoff diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md index f694afb5..7faf07ad 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md @@ -57,7 +57,7 @@ The running control planes were verified to receive the expected DSP callback, ` The negotiation initiated by `connector-b` against `connector-a` reached `FINALIZED` on both connectors. The consumer and provider records share agreement `f48bd1f2-8c0c-4e0d-a9f1-890bf2c4ad48`, and filtered control-plane logs show the DSP agreement, verification, and finalization exchange. See [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md). -The collected evidence demonstrates encrypted DSP transport and a successful connector-to-connector agreement exchange. The proposed assessment is Full Coverage because the authenticated connector workflow finalized on both sides over the validated HTTPS DSP path. The captured logs do not provide a standalone authentication-event record that attributes peer authentication to a specific credential or verification decision; Casper should confirm this interpretation or change the score to Significant Coverage during review. +The collected evidence demonstrates encrypted DSP transport and a successful connector-to-connector agreement exchange. The proposed assessment is Full Coverage because the authenticated connector workflow finalized on both sides over the validated HTTPS DSP path. The captured logs do not provide a standalone authentication-event record that attributes peer authentication to a specific credential or verification decision. #### Supplementary platform checks @@ -80,7 +80,7 @@ Collected observability data is persisted in Elasticsearch on a bound IONOS HDD | **Minimal Coverage:** The solution meets up to 25% of the technical requirements. It offers very basic functionality, with significant limitations. Some minimal security measures might be in place, but critical features like connector authentication or comprehensive encryption are largely absent or inadequately implemented. | Not selected | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md) | Runtime identity and authentication architecture evidence exceeds basic configuration-only coverage. | | **Partial Coverage:** The solution satisfies approximately 50% of the technical requirements. While it includes some important features and may partially support security protocols and authentication processes, there are still substantial gaps that limit its overall effectiveness and reliability. | Not selected | [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | A completed encrypted DSP agreement exchange exceeds partial coverage. | | **Significant Coverage:** The solution covers about 80% of the technical requirements. It demonstrates a strong alignment with the desired technical criteria, including robust support for channel encryption and authentication mechanisms, though there may be minor areas where further improvement is needed. | Not selected | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`TLS-03`](./resources-protoemds_final_stack/evidence-manifest.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | The same evidence supports Full Coverage as the proposed reviewer interpretation. | -| **Full Coverage:** The solution fully meets all specified technical requirements. It provides comprehensive support for all key features, including complete compatibility with channel encryption protocols (e.g., TLS) and effective connector authentication for secure data-sharing negotiations. There are no significant gaps, making the solution highly suitable for deployment. | 4 (proposed, pending reviewer confirmation) | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`TLS-03`](./resources-protoemds_final_stack/evidence-manifest.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | Proposed for Casper's review: both connectors finalized the same agreement over the validated HTTPS DSP path. No standalone authentication-event record was captured. | +| **Full Coverage:** The solution fully meets all specified technical requirements. It provides comprehensive support for all key features, including complete compatibility with channel encryption protocols (e.g., TLS) and effective connector authentication for secure data-sharing negotiations. There are no significant gaps, making the solution highly suitable for deployment. | 4 | [`AUTH-01`](./resources-protoemds_final_stack/auth-01-live-authentication-configuration.md), [`AUTH-02`](./resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md), [`TLS-01`](./resources-protoemds_final_stack/tls-01-connector-a-did-and-certificate.md), [`TLS-02`](./resources-protoemds_final_stack/tls-02-connector-b-did-and-certificate.md), [`TLS-03`](./resources-protoemds_final_stack/evidence-manifest.md), [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) | Both connectors finalized the same agreement over the validated HTTPS DSP path. No standalone authentication-event record was captured. | **Functional Suitability Quality Metric: 4** From f472309df84fd66a5af642f20b414f5beb7a8200 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 14:56:41 +0200 Subject: [PATCH 08/10] chore: some last optimizations --- README.md | 2 +- .../auth-02-kubernetes-runtime-configuration-binding.md | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/README.md b/README.md index c1bc485a..683be062 100644 --- a/README.md +++ b/README.md @@ -140,7 +140,7 @@ Last updated: 2026-06-23 | [3.1.1.4] | [Data product survey: Discover - Consult data space catalogue](tests/data_product_survey/discover/consult_data_space_catalogue/test_3_1_1_4/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/data_product_survey/discover/consult_data_space_catalogue/test_3_1_1_4/result_protoemds_final_stack.md) | | [4.2.1.1] | [Sharing agreement: Negotiation - Negotiating sharing agreement](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_1/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_1/result_protoemds_final_stack.md) | | [4.2.1.3] | [Sharing agreement: Negotiation - Negotiating sharing agreement](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_3/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_3/result_protoemds_final_stack.md) | -| [4.2.1.6] | [Sharing agreement: Negotiation - Negotiating sharing agreement](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md) | +| [4.2.1.6] | [Sharing agreement: Negotiation - Negotiating sharing agreement](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/test.md) | Integration | Yes | [protoemds_final_stack proposed](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md) | | [4.2.1.7] | [Sharing agreement: Negotiation - Negotiating sharing agreement](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_7/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_7/result_protoemds_final_stack.md) | | [4.2.3.1] | [Sharing agreement: Negotiation - Refusal or registration of sharing agreement](tests/sharing_agreement/negotiation/refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/refusal_or_registration_of_sharing_agreement/test_4_2_3_1/result_protoemds_final_stack.md) | | [4.2.3.2] | [Sharing agreement: Negotiation - Refusal or registration of sharing agreement](tests/sharing_agreement/negotiation/refusal_or_registration_of_sharing_agreement/test_4_2_3_2/test.md) | Integration | Yes | [protoemds_final_stack pending](tests/sharing_agreement/negotiation/refusal_or_registration_of_sharing_agreement/test_4_2_3_2/result_protoemds_final_stack.md) | diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md index a14bb0d1..e7239393 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/auth-02-kubernetes-runtime-configuration-binding.md @@ -6,8 +6,6 @@ This evidence verifies configuration delivery to the running Kubernetes control | --- | --- | --- | | Capture date | 2026-08-13 | 2026-08-13 | | Control-plane Deployment | `connector-a-controlplane` | `connector-b-controlplane` | -| Deployment generation / observed generation | `4 / 4` | `2 / 2` | -| Ready replicas | `1` | `1` | | ConfigMap imported through `envFrom` | `connector-a-controlplane` | `connector-b-controlplane` | | Required non-secret keys present in source ConfigMap | DSP callback, DID issuer, participant ID, STS token URL, OpenTelemetry traces | DSP callback, DID issuer, participant ID, STS token URL, OpenTelemetry traces | | Ready control-plane Pod | `connector-a-controlplane-7cf9b77f66-v4rjf` | `connector-b-controlplane-95f45f8b4-xg74v` | From 7ef322cf0e98da0469f2a2f324ad53da9c9b0c73 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 15:07:24 +0200 Subject: [PATCH 09/10] chore: remove observability jaeger port missmatch information - issue is fixed --- .../log-01-observability-storage-access.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md index 5bed8ea3..06c33aeb 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/resources-protoemds_final_stack/log-01-observability-storage-access.md @@ -5,7 +5,7 @@ This supplementary platform check assesses storage, transport, and application-a ## Live inventory | Component | Deployment state | Service exposure | Persistence or access configuration | -| --- | --- | --- | +| --- | --- | --- | --- | | Elasticsearch | Ready `1/1` | ClusterIP port `9200` | Data mounted from PVC `observa-elasticsearch-data` | | Kibana | Ready `1/1` | ClusterIP port `5601` | Connects to Elasticsearch with a Secret-backed password | | Jaeger | Ready `1/1` | ClusterIP UI/API port `16686` | Stores spans in Elasticsearch with Secret-backed credentials | @@ -30,8 +30,6 @@ The Elasticsearch persistence layer exists, but secure storage cannot be claimed ## Controlled application-access checks -Short-lived direct pod port-forwards were used because the observability services are ClusterIP-only and the Jaeger Service UI port is misconfigured: service port `16686` targets `16687`, while the Jaeger pod listens on `16686`. - | Endpoint | Unauthenticated outcome | Approved authenticated outcome | | --- | --- | --- | | Elasticsearch root API | `401 Unauthorized` | `200 OK` for a read-only cluster-health request; response body not retained | @@ -48,7 +46,6 @@ The unauthenticated Jaeger trace result is a material access-control finding: an 1. Elasticsearch persistence is present, but encryption at rest is not evidenced. 2. Elasticsearch, Kibana, Jaeger, and OTel internal transport settings do not provide TLS protection for the recorded paths. 3. Jaeger application endpoints permit unauthenticated trace access within the cluster network. -4. No explicit observability namespace NetworkPolicy or RBAC resources were found. Authorization to negotiation logs, status messages, and APIs belongs to [test `4.2.3.1`](../../../refusal_or_registration_of_sharing_agreement/test_4_2_3_1/test.md). Trace-viewer confidentiality also relates to [test `4.2.4.2`](../../../update_observability_registry/test_4_2_4_2/test.md). Log persistence, access, and immutable-storage expectations relate to [test `5.3.3.4`](../../../../../data_sharing/post-sharing_activities/log_data_sharing_transaction/test_5_3_3_4/test.md). From 7930a0ea373169ddfb9566a446ff4c03d87dac80 Mon Sep 17 00:00:00 2001 From: Wilhelm Rosinski Date: Thu, 13 Aug 2026 16:42:46 +0200 Subject: [PATCH 10/10] fix: unclosed
mdx issue --- .../test_4_2_1_6/result_protoemds_final_stack.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md index 7faf07ad..bcee83d5 100644 --- a/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md +++ b/tests/sharing_agreement/negotiation/negotiating_sharing_agreement/test_4_2_1_6/result_protoemds_final_stack.md @@ -21,7 +21,7 @@ This section identifies the technical context in which the protoEMDS Final Stack | Reviewer | Casper (imec) | | Deployment model assessed | CaaS / IONOS-managed deployment | | Target environment | Ionos DCD `EMDS-PROD` | -| EDC version / release | emds-edc-connector `9916cc56b682ae70988300d301b752ca8eb05121`
based on eclipse edc connector `0.10.0` | +| EDC version / release | emds-edc-connector `9916cc56b682ae70988300d301b752ca8eb05121`
based on eclipse edc connector `0.10.0` | | Connector deployment reference | `deployEMDS-k8s-deployment`, branch `prepare-prod`, commit `846e5f1d7a388e664fe9e4942e553021752d63c6` | | Assessment evidence | [`resources-protoemds_final_stack/evidence-manifest.md`](./resources-protoemds_final_stack/evidence-manifest.md), including [`DSP-01`](./resources-protoemds_final_stack/dsp-01-approved-minimal-negotiation.md) |