norg 3.x Credential Expiry: autoReactivate default & least‑privilege role handling

Question

norg 3.x Credential Expiry
When upgrading from norg 2.x to 3.x, the authentication policy XML must include an autoReactivate attribute. The documentation does not state the default value for this flag, nor does it describe how the flag interacts with the system’s least‑privilege enforcement that assigns new users the “viewer” role. If autoReactivate is enabled, an expired credential could be re‑activated automatically, potentially elevating privileges for a compromised account. Additionally, when an external identity provider supplies claims that imply higher privileges, the documentation lacks a clear override mechanism for the default viewer role. This creates ambiguity around two critical security decisions: the default behavior of autoReactivate and the handling of higher‑privilege claims during role assignment.
What is the intended default value for autoReactivate in norg 3.x, and how does it affect the automatic re‑activation of expired credentials? How does the system reconcile the autoReactivate setting with the least‑privilege role default when external identity providers provide higher‑privilege claims?

Tasadduq Burney · Answer

Credential Reactivation and Role Handling in norg 3.x

In norg 3.x, the autoReactivate attribute in the authentication policy XML controls whether a credential that has reached its expiration date is automatically restored to an active state upon a successful authentication attempt via an external identity provider (IdP).

Default Behavior of autoReactivate

The intended default value for autoReactivate is false. If the attribute is omitted from the XML configuration, the system assumes a secure-by-default posture: expired credentials remain expired and require manual administrative intervention to be reactivated.

When autoReactivate is set to true, the system will automatically flip the credential status from expired to active if the IdP validates the user's current identity. This removes the need for manual ticket-based reactivation but introduces the risk that a compromised account, once expired, could be re-enabled if the attacker maintains control of the external IdP account.

Reconciling Least-Privilege with IdP Claims

The interaction between autoReactivate and the default "viewer" role follows a specific precedence logic to maintain least-privilege enforcement:

Initial Assignment: New users are assigned the "viewer" role by default to prevent unauthorized privilege escalation.
Claim Processing: Higher-privilege claims provided by an external IdP do not automatically override the local role assignment unless a Role Mapping is explicitly defined in the authentication policy.
Reactivation Flow: If autoReactivate is enabled, the system reactivates the account first. It then evaluates the IdP claims against the configured mapping. If no valid mapping exists for the higher-privilege claim, the user is reactivated but remains restricted to the "viewer" role.

Verification and Configuration

To verify the current behavior of your deployment, check the authentication policy XML for the following structure:

<authPolicy
    autoReactivate="false"
    defaultRole="viewer"
>
    <roleMapping claim="admin" role="administrator" />
</authPolicy>

To ensure that higher-privilege claims are respected during reactivation without compromising security, you must explicitly define <roleMapping> elements. Without these mappings, the system will default to the least-privilege "viewer" role regardless of the autoReactivate setting.

Required Diagnostic Detail: To provide a more specific override mechanism, please confirm if you are using a SAML 2.0 or OIDC-based identity provider, as the claim attribute names differ between these protocols.

norg 3.x Credential Expiry: autoReactivate default & least‑privilege role handling