86 lines
3.2 KiB
Markdown
86 lines
3.2 KiB
Markdown
|
---
|
|||
|
|
id: ADR-0001
|
|||
|
|
title: NetKingdom identity for coulomb.social
|
|||
|
|
status: accepted
|
|||
|
|
date: 2026-08-09
|
|||
|
|
workplan: CSOC-WP-0002
|
|||
|
|
task: CSOC-WP-0002-T01
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# ADR-0001 — NetKingdom identity for coulomb.social
|
|||
|
|
|
|||
|
|
## Status
|
|||
|
|
|
|||
|
|
Accepted (2026-08-09).
|
|||
|
|
|
|||
|
|
## Context
|
|||
|
|
|
|||
|
|
coulomb.social is being reestablished as a standalone business application
|
|||
|
|
(DR-2 B) on the Railiance delivery lane. The business-app service contract
|
|||
|
|
v0.1 defaults to **app-local accounts** (DR-3 A) with a bounded auth module
|
|||
|
|
for a later OIDC switch.
|
|||
|
|
|
|||
|
|
A social product with many members is a poor fit for a private password
|
|||
|
|
database inside the app: credential lifecycle, MFA, and user-domain profiles
|
|||
|
|
already exist (or are governed) in the NetKingdom landscape.
|
|||
|
|
|
|||
|
|
## Decision
|
|||
|
|
|
|||
|
|
1. **Authentication** uses only the **NetKingdom IAM Profile** (OIDC + PKCE).
|
|||
|
|
The app depends on the profile contract, not on KeyCape vs Keycloak
|
|||
|
|
implementation details.
|
|||
|
|
|
|||
|
|
2. **User-domain facts** (account, profile, memberships, identity links) are
|
|||
|
|
owned by **user-engine**. This app maps `(issuer, sub)` to a local
|
|||
|
|
`Member` row for session convenience and never stores passwords.
|
|||
|
|
|
|||
|
|
3. **Authorization** for protected actions is decided by **flex-auth** (PDP).
|
|||
|
|
The app is a PEP only (fail-closed when the PDP is unavailable for
|
|||
|
|
sensitive actions). Dev may use a local deny-by-default stub until the
|
|||
|
|
protected system is registered.
|
|||
|
|
|
|||
|
|
4. **Browser session** after successful OIDC is an application session
|
|||
|
|
(Django session / signed cookie). Tokens are not treated as long-lived
|
|||
|
|
API credentials in the browser.
|
|||
|
|
|
|||
|
|
5. **Tenant model**: all client-owned data is keyed by `tenant_id` from the
|
|||
|
|
first migration (Binky Hedgehog = client #1 / reference tenant).
|
|||
|
|
|
|||
|
|
6. **Relationship to DR-3 A**: the contract’s “app-local baseline” remains
|
|||
|
|
valid for simple single-tenant tools (e.g. vergabe-teilnahme v1). This ADR
|
|||
|
|
**specializes** coulomb.social onto NetKingdom identity as a product
|
|||
|
|
decision; the auth code still lives in one module (§2.3) so issuer mode
|
|||
|
|
can change without rewriting the product.
|
|||
|
|
|
|||
|
|
### Issuer modes
|
|||
|
|
|
|||
|
|
| Mode | When |
|
|||
|
|
|------|------|
|
|||
|
|
| Dev mock claims (`DEBUG` + `OIDC_ENABLED=false`) | Local unit/integration tests and offline shell work |
|
|||
|
|
| local-identity / KeyCape | Bootstrap and lightweight platform environments |
|
|||
|
|
| Keycloak expanded | Production / enterprise MFA & federation when platform provides it |
|
|||
|
|
|
|||
|
|
### Non-goals
|
|||
|
|
|
|||
|
|
- App-local password / MFA store
|
|||
|
|
- Bubble as identity provider
|
|||
|
|
- Content migration from Bubble in this identity track
|
|||
|
|
- Owning KeyCape, Keycloak, user-engine, or flex-auth codebases
|
|||
|
|
|
|||
|
|
## Consequences
|
|||
|
|
|
|||
|
|
- Scaffold uses Django aligned with the business delivery lane, with a
|
|||
|
|
dedicated `identity` app as the sole OIDC/session boundary.
|
|||
|
|
- OpenBao (or local 0600 files) holds OIDC client secrets; nothing secret
|
|||
|
|
in Git.
|
|||
|
|
- Content re-claim is a separate workplan after the authenticated shell
|
|||
|
|
works.
|
|||
|
|
|
|||
|
|
## References
|
|||
|
|
|
|||
|
|
- `workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md`
|
|||
|
|
- `net-kingdom/canon/standards/iam-profile_v0.2.md` (and v0.3)
|
|||
|
|
- `net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md`
|
|||
|
|
- `the-custodian/canon/standards/business-app-service-contract_v0.1.md`
|
|||
|
|
- `the-custodian/docs/business-platform-decision-records.md` (DR-2, DR-3)
|