mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
58 lines
1.8 KiB
Markdown
58 lines
1.8 KiB
Markdown
# API Reference: Implementing Identity Verification for Zero Trust
|
|
|
|
## CISA Zero Trust Maturity Model - Identity Pillar
|
|
|
|
| Level | Description | Requirements |
|
|
|-------|-------------|-------------|
|
|
| Traditional | Password-based, static policies | Basic auth |
|
|
| Initial | MFA deployed, basic conditional access | MFA for all users |
|
|
| Advanced | Phishing-resistant MFA, risk-based | FIDO2, risk signals |
|
|
| Optimal | Continuous verification, passwordless | Behavioral analytics |
|
|
|
|
## Azure AD Conditional Access API
|
|
|
|
```python
|
|
import requests
|
|
headers = {"Authorization": "Bearer <token>"}
|
|
policies = requests.get(
|
|
"https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies",
|
|
headers=headers).json()
|
|
```
|
|
|
|
## FIDO2/WebAuthn Registration
|
|
|
|
```javascript
|
|
const credential = await navigator.credentials.create({
|
|
publicKey: {
|
|
rp: { name: "Example Corp" },
|
|
user: { id: userId, name: email, displayName: name },
|
|
challenge: serverChallenge,
|
|
pubKeyCredParams: [{ type: "public-key", alg: -7 }],
|
|
authenticatorSelection: { residentKey: "required" },
|
|
}
|
|
});
|
|
```
|
|
|
|
## Conditional Access Signals
|
|
|
|
| Signal | Source | Zero Trust Level |
|
|
|--------|--------|-----------------|
|
|
| Device compliance | MDM/Intune | Initial |
|
|
| Location/IP | Network context | Initial |
|
|
| User risk | Identity Protection | Advanced |
|
|
| Sign-in risk | Real-time analysis | Advanced |
|
|
| Session behavior | UEBA | Optimal |
|
|
|
|
## Okta Authentication Policies API
|
|
|
|
```bash
|
|
curl -X GET "https://DOMAIN.okta.com/api/v1/policies?type=ACCESS_POLICY" \
|
|
-H "Authorization: SSWS <token>"
|
|
```
|
|
|
|
### References
|
|
|
|
- CISA Zero Trust Maturity Model: https://www.cisa.gov/zero-trust-maturity-model
|
|
- NIST SP 800-207: https://csrc.nist.gov/pubs/sp/800/207/final
|
|
- FIDO Alliance: https://fidoalliance.org/fido2/
|