sec(glauth): rotate serviceaccount passsha256; scrub retired plaintext from comments (mxaccessgw SEC-36)

infra/glauth/README.md

@@ -20,7 +20,9 @@ each app maps only its own family and ignores the rest.
 | `Gw*` (561x) | MxGateway dashboard (config-mapped) | GwAdmin 5610, GwReader 5611 |
 | `OtOpcUa-*` (57xx) | OtOpcUa AdminUI (DB-mapped) | Admins 5701, Designers 5702, Viewers 5703 |
 
-**Users** (all password `password` except `serviceaccount` → `serviceaccount123`):
+**Users** (all password `password` except `serviceaccount`, whose password is rotated out-of-band —
+SEC-36 — and is **not** recorded in this repo; it lives only in the `passsha256` below and each
+app's secret store):
 
 - **`serviceaccount`** (`cn=serviceaccount,dc=zb,dc=local`) — the single bind account every app
   uses for search-then-bind. Has a `search *` capability.
@@ -51,11 +53,13 @@ ssh dohertj2@10.100.0.35 'cd ~/zb-glauth && docker compose up -d --force-recreat
 
 ## Verify
 
-Bind as the service account and confirm `multi-role` spans all four families:
+Bind as the service account and confirm `multi-role` spans all four families. Substitute the
+current service-account password (rotated out-of-band, SEC-36 — take it from the consuming app's
+secret store, e.g. the gateway's `MxGateway:Ldap:ServiceAccountPassword`):
 
 ```bash
 ldapsearch -x -H ldap://10.100.0.35:3893 \
-  -D cn=serviceaccount,dc=zb,dc=local -w serviceaccount123 \
+  -D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
   -b dc=zb,dc=local "(cn=multi-role)" memberOf
 # → result: 0 Success. memberOf comes back as group DNs (e.g. ou=SCADA-Admins,ou=groups,dc=zb,dc=local)
 #   spanning all four families: SCADA-*, ReadOnly/Write*/AlarmAck, GwAdmin/GwReader, OtOpcUa-*.
@@ -75,7 +79,7 @@ No `ldapsearch` locally? Run it from a throwaway container:
 
 ```bash
 docker run --rm alpine:3.20 sh -c 'apk add -q openldap-clients >/dev/null 2>&1 && \
-  ldapsearch -x -H ldap://10.100.0.35:3893 -D cn=serviceaccount,dc=zb,dc=local -w serviceaccount123 \
+  ldapsearch -x -H ldap://10.100.0.35:3893 -D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
   -b dc=zb,dc=local "(cn=multi-role)" memberOf'
 ```
 

infra/glauth/config.toml

@@ -68,16 +68,16 @@
   gidnumber = 5703
 
 # ── Users ────────────────────────────────────────────────────────────
-# All passwords are "password" except serviceaccount ("serviceaccount123").
-# sha256("password")          = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
-# sha256("serviceaccount123") = af29d0e5c9801ae98a999ed3915e1cf428a64b4b62b3cf221b6336cce0398419
+# All passwords are "password". The serviceaccount password is rotated
+# out-of-band (SEC-36) and is not recorded here.
+# sha256("password") = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
 
 # The single bind account every app uses (search-then-bind).
 [[users]]
   name = "serviceaccount"
   uidnumber = 5999
   primarygroup = 5601
-  passsha256 = "af29d0e5c9801ae98a999ed3915e1cf428a64b4b62b3cf221b6336cce0398419"
+  passsha256 = "e9c2967c773d8960adf91d02f1c26652ed9d08a07f93d3beeb1ade3aede3e6bf"
     [[users.capabilities]]
     action = "search"
     object = "*"

infra/glauth/docker-compose.yml

@@ -1,7 +1,8 @@
 # Shared dev GLAuth for OtOpcUa + MxAccessGateway + ScadaBridge.
 # Deploy on the shared Docker host 10.100.0.35:  docker compose up -d
 # Verify:  ldapsearch -x -H ldap://10.100.0.35:3893 \
-#            -D cn=serviceaccount,dc=zb,dc=local -w serviceaccount123 \
+#            -D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
+#          (serviceaccount password is rotated out-of-band — SEC-36 — and is not recorded here)
 #            -b dc=zb,dc=local "(cn=multi-role)" memberOf
 name: zb-shared-glauth
 services: