wrouesnel / vouch / 37315189611

51%

push

github

Verify the password without leaving the account unlocked, and gate the unlock on a committed audit record

Security review changes to how the locked account is handled, plus a
durable, pluggable audit trail.

Account status and the password check:
- The target stays locked throughout. At the claim, vouch first confirms
  (via a bind) the account is genuinely locked and eligible, so claiming
  can't be used to unlock or lock an innocent account.
- It then briefly clears the lockout, binds as the user to check the
  password, and re-locks the account (directory.VerifyWhileLocked). AD
  forbids writing a non-zero lockoutTime, so the re-lock is done with
  failed binds up to the account's lockout threshold (read from the
  resultant PSO or the domain policy). Verified empirically on Samba.
- No password is kept between steps. A wrong password leaves the account
  locked; the user can retry. The permanent unlock happens only at
  confirm, so a wrong password can never leave an account unlocked.
- If the account can't be re-locked, it's disabled as a fail-safe and a
  relock_failed event is recorded.

Audit (pkg/audit):
- Pluggable sinks: file (fsync per line), SQL (pgx/mysql/sqlite, pure-Go,
  CGO-free), and HTTP including Splunk HEC with retries. Fan-out writes to
  all; a failure in any fails the write.
- The final unlock is gated: Confirm commits an unlock_authorized record
  and clears the lockout only if the sink commits it. If it can't, the
  unlock is refused (audit_failed) and the account stays locked.

Removes disableOnFailedVerification and the verification_failed outcome,
which no longer apply now that a wrong password never unlocks the account.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014EBFSg4NggxD8rZCRVtH1U

280 of 542 new or added lines in 12 files covered. (51.66%)

995 of 1946 relevant lines covered (51.13%)

7.68 hits per line