tegwick
29a9ff735e
Prefer verified KeyCape id_token claims when /userinfo returns 401; soft-fail userinfo. Add CSOC-WP-0003 registration entry (disabled until NetKingdom URL), AAL step-up hooks, smoke/cutover evidence for tegwick OIDC without MFA.
96 lines
3 KiB
Markdown
96 lines
3 KiB
Markdown
---
|
|
id: CSOC-WP-0003
|
|
type: workplan
|
|
title: "Add NetKingdom self-registration and profile-aware assurance"
|
|
domain: communication
|
|
repo: coulomb-social
|
|
status: active
|
|
owner: codex
|
|
topic_slug: coulomb-social
|
|
created: "2026-08-09"
|
|
updated: "2026-08-09"
|
|
depends_on:
|
|
- CSOC-WP-0002
|
|
- NK-WP-0025
|
|
- USER-WP-0022
|
|
- KEY-WP-0008
|
|
state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
|
|
---
|
|
|
|
# CSOC-WP-0003 - self-registration and assurance
|
|
|
|
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
|
|
creation entry point and optional profile/action step-up.
|
|
|
|
## T01 - Preserve and prove first-login JIT profile creation
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
|
|
```
|
|
|
|
Harden the existing issuer/subject keyed Member creation, concurrent callback
|
|
behavior, verified ID-token processing, and user-engine link. Preserve the
|
|
current uncommitted CSOC-WP-0002 claim-verification work.
|
|
|
|
Done when an existing LLDAP identity gets exactly one ordinary Member and
|
|
repeat login updates safe display fields without changing identity ownership.
|
|
|
|
Covered by the issuer/subject uniqueness constraint, unusable local passwords,
|
|
idempotent session establishment tests, and verified ID-token claim handling.
|
|
|
|
## T02 - Add Create NetKingdom account
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
|
|
```
|
|
|
|
Add a landing-page registration choice using the configured NetKingdom public
|
|
registration URL. The configured URL owns any signed return context. Completion must
|
|
start a fresh OIDC flow before creating an application session.
|
|
|
|
Done when a new user can leave coulomb.social, register, and return through
|
|
the same callback/JIT path without open redirects.
|
|
|
|
The application entry point is implemented and ignores browser-supplied
|
|
redirect parameters. It remains disabled until the NetKingdom public
|
|
registration URL and verified-mail flow are deployed.
|
|
|
|
## T03 - Support profile/action step-up
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
|
|
```
|
|
|
|
Use AAL1 for ordinary member sessions. When profile policy or a protected
|
|
action requires MFA, restart authorization with AAL2 acr_values and verify the
|
|
returned assurance claim before completing the action.
|
|
|
|
Done when tegwick can use ordinary login without MFA and opt into or encounter
|
|
MFA step-up without affecting another member.
|
|
|
|
Implemented explicit `?assurance=aal2`, OIDC `acr_values`, and callback-side
|
|
assurance validation. Ordinary login sends no ACR request.
|
|
|
|
## T04 - Deploy and run Case A / Case B matrix
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T04
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
|
|
```
|
|
|
|
Test known LLDAP user, new registration, repeated/concurrent callback,
|
|
email collision, state replay, disabled identity, local-account coexistence,
|
|
password-only login, AAL2 step-up, logout, and rollback on railiance01.
|
|
|
|
Done when both requested cases pass with non-secret evidence.
|