coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WP-0025 SSO cutover except group allowlist residual.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 29s
Details

Browse source 
Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
This commit is contained in:
tegwick 2026-07-22 10:23:36 +02:00
parent 27c087bcb4
commit 91353df7d0
8 changed files with 151 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

63
workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
View file

@ -116,7 +116,7 @@ state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
```task
id: ACTIVITY-WP-0025-T03
status: progress
status: done
priority: high
state_hub_task_id: "7084f7d5-4181-4dfa-b239-0dad15efbae9"
```
@ -134,7 +134,7 @@ port-forward; unauthorized gets login or 403.
```task
id: ACTIVITY-WP-0025-T04
status: progress
status: done
priority: high
state_hub_task_id: "99b36f31-eb19-4f96-b3f1-9ac1ab02d78f"
```
@ -151,7 +151,7 @@ port-forward, under SSO.
```task
id: ACTIVITY-WP-0025-T05
status: progress
status: done
priority: high
state_hub_task_id: "77fff202-bfb6-49eb-b8e5-3760abacc8bd"
```
@ -186,7 +186,7 @@ account.
```task
id: ACTIVITY-WP-0025-T07
status: progress
status: done
priority: medium
state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
```
@ -201,7 +201,7 @@ state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
```task
id: ACTIVITY-WP-0025-T08
status: todo
status: done
priority: medium
state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
```
@ -215,12 +215,12 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
## Success criteria
- [ ] HTTPS SSO URLs for ops console and Temporal UI (no port-forward required)
- [ ] Only authorized IdP group can access
- [ ] Ops mutations attribute to SSO identity; audits show principal
- [ ] Ops nav Temporal link points at SSO Temporal URL
- [ ] Runbook documents SSO primary + break-glass port-forward
- [ ] SCOPE G10 updated to reflect UI SSO posture
- [x] HTTPS SSO URLs for ops console and Temporal UI (no port-forward required)
- [ ] Only authorized IdP group can access — **MVP: any Authelia user; T06 residual**
- [x] Ops mutations attribute to SSO identity; audits show principal (`sso:<user>`)
- [x] Ops nav Temporal link points at SSO Temporal URL
- [x] Runbook documents SSO primary + break-glass port-forward
- [x] SCOPE G10 updated to reflect UI SSO posture
## Dependencies / coordination
@ -250,13 +250,36 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
| --- | --- | --- |
| T01 | done | Hosts: activity.coulomb.social + temporal.coulomb.social; docs/ops-sso-access.md |
| T02 | done | Reuse Authelia + Traefik ForwardAuth (sso ns); not oauth2-proxy |
| T03 | progress | Ingress + middleware manifests landed; **blocked on DNS A records** for cert |
| T04 | progress | Temporal Ingress manifest + CORS env; same DNS gate |
| T05 | progress | SSO headers preferred over shared token in ops_auth |
| T06 | wait | LLDAP group activity-core-operators + Authelia rules (net-kingdom) |
| T07 | progress | Runbook + design doc updated |
| T08 | todo | After DNS/cert Ready: smoke HTTPS + SSO login |
| T03 | done | Ingress + cert Ready; unauth → 302 auth.coulomb.social |
| T04 | done | Temporal Ingress + cert Ready; `ACTIVITY_CORE_TEMPORAL_UI_URL` + CORS set |
| T05 | done | SSO `Remote-User` preferred; token break-glass; tests + redeploy |
| T06 | wait | LLDAP group activity-core-operators + Authelia domain rules (net-kingdom) |
| T07 | done | Runbook + k8s README + design doc: SSO primary, port-forward break-glass |
| T08 | done | See verification checklist below |
**Operator action required:** create DNS A records for both hosts → 92.205.62.239,
then apply `k8s/railiance/30-*.yaml`–`32-*.yaml` and set
`ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social` on actcore-api.
### Verification checklist (T08) — 2026-07-22
| Check | Result |
| --- | --- |
| DNS A → 92.205.62.239 for both hosts | ok |
| Certificate Ready (`actcore-ops-tls`, `actcore-temporal-ui-tls`) | ok |
| Unauth HTTPS `/ops/ui` → Authelia login redirect | ok |
| Unauth HTTPS Temporal host → Authelia login redirect | ok |
| Services remain ClusterIP (no public LB) | ok |
| Mutation without SSO/token → 401 fail-closed | ok |
| Mutation with `Remote-User` → auth passes (404 only if unknown def) | ok |
| `ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social` | ok |
| `TEMPORAL_CORS_ORIGINS` includes public Temporal host | ok |
| Unit tests `test_ops_auth` + `test_ops_console_api` | 18 passed |
| Image `activity-core:railiance01-prod` rebuilt, imported, api/worker/router rolled | ok |
| NetworkPolicy ingress→services | **skipped** (optional; ClusterIP + Authelia sufficient for MVP) |
| Full browser login + Run now under real MFA session | **operator smoke** (credentials not in agent) |
### Residual (keeps WP active)
**T06** — restrict Authelia access to LLDAP group `activity-core-operators`
(net-kingdom Authelia access_control rules). Until then any authenticated
Authelia user can reach the UIs (org-wide SSO, not least-privilege).
**Operator:** open https://activity.coulomb.social/ops/ui once, confirm inventory
loads and a safe mutation (or dry path) shows `sso:<you>` in `/ops/audits`.