codex
79e9cd9022
These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
113 lines
3.7 KiB
Markdown
113 lines
3.7 KiB
Markdown
---
|
|
id: HF-WP-0004
|
|
type: workplan
|
|
title: "Integrate coulomb.social with NetKingdom login and JIT profiles"
|
|
domain: infotech
|
|
repo: helix-forge
|
|
status: archived
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-09"
|
|
updated: "2026-08-09"
|
|
depends_on:
|
|
- NK-WP-0025
|
|
- USER-WP-0022
|
|
- KEY-WP-0008
|
|
state_hub_workstream_id: "de95c70e-f4e1-5f10-8274-a389a9c94f9f"
|
|
---
|
|
|
|
# HF-WP-0004 - coulomb.social login and first-login profile
|
|
|
|
Add NetKingdom OIDC as an alternative to coulomb.social local registration.
|
|
The application keeps ownership of its local profile and authorization while
|
|
using KeyCape for authentication.
|
|
|
|
## T01 - Pin the OIDC consumer and account-link contract
|
|
|
|
```task
|
|
id: HF-WP-0004-T01
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "29d034db-57c0-5cea-8f4f-385a15e36a18"
|
|
```
|
|
|
|
Implement authorization-code plus PKCE against the existing coulomb-social
|
|
KeyCape client and exact production callback. Store the stable issuer/subject
|
|
link separately from username and email. Define explicit handling for an
|
|
existing local account whose verified email matches the OIDC identity.
|
|
|
|
Done when email matching cannot silently attach or replace an existing local
|
|
account.
|
|
|
|
## T02 - Create the profile idempotently on first login
|
|
|
|
```task
|
|
id: HF-WP-0004-T02
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "00d31d83-bab2-57a6-a0a0-7708f777e266"
|
|
```
|
|
|
|
On a valid callback, atomically find-or-create the coulomb.social application
|
|
profile keyed by issuer/subject, seed ordinary-user defaults, establish the
|
|
application session, and redirect to the intended page. Repeated callbacks,
|
|
concurrent tabs, and retries must return the same profile.
|
|
|
|
Done when an existing LLDAP user with no application profile can sign in and
|
|
receive exactly one regular coulomb.social profile.
|
|
|
|
## T03 - Add login and registration choices
|
|
|
|
```task
|
|
id: HF-WP-0004-T03
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "7a405cf4-f05e-52f7-ad4d-2b7f1e6b8b95"
|
|
```
|
|
|
|
Offer Sign in with NetKingdom, Create NetKingdom account, and the existing
|
|
local-account path according to product policy. The registration choice uses
|
|
the signed return flow from NK-WP-0025; completion starts a fresh OIDC login.
|
|
Avoid user enumeration and open redirects.
|
|
|
|
Done when a completely new person can register from the coulomb.social
|
|
landing page and return as an authenticated regular user.
|
|
|
|
## T04 - Enforce profile/action assurance
|
|
|
|
```task
|
|
id: HF-WP-0004-T04
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "bd570133-3861-5ea6-9bef-eaf011f4ccf8"
|
|
```
|
|
|
|
Accept password-level assurance for ordinary profiles unless the application
|
|
profile or requested action requires MFA. For step-up, send a fresh KeyCape
|
|
authorization request and verify the returned assurance before completing the
|
|
action. Never infer MFA from email or application session age alone.
|
|
|
|
Done when the attended tegwick profile works without MFA by default and can
|
|
be configured to require MFA without changing another user's profile.
|
|
|
|
## T05 - Migrate, deploy, and prove both cases
|
|
|
|
```task
|
|
id: HF-WP-0004-T05
|
|
status: cancel
|
|
priority: high
|
|
state_hub_task_id: "ffbf15fe-0166-5491-bb68-233c935f6519"
|
|
```
|
|
|
|
Add database migration, uniqueness constraints, rollback, session security,
|
|
logout, audit correlation, and railiance deployment configuration. Test Case A
|
|
existing LLDAP user/JIT profile and Case B new registration/LLDAP creation,
|
|
plus collisions, replay, concurrent callback, suspended identity, unlink,
|
|
local-account coexistence, and step-up.
|
|
|
|
Done when both cases pass on the rebuilt coulomb.social application and local
|
|
account rollback remains available.
|
|
|
|
2026-08-09: Cancelled before implementation because repository inspection
|
|
found the Django consumer in the dedicated coulomb-social repository, where
|
|
CSOC-WP-0002 already owns the NetKingdom shell. Successor: CSOC-WP-0003.
|