From 37cc80561c61bcba324f98cb1ea11210d52c6090 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 27 Sep 2026 19:03:36 +0200 Subject: [PATCH] Record INFD-IN-0005 root cause and key-cape fix platform-root's refused approval of infd-20260927-b01 reproduced this intake's predicted failure exactly: key-cape was backdating a just-completed MFA to a stale kc_login cookie, understating freshness for flex-auth's 900s review window. Fixed upstream in key-cape (ADHOC-2026-09-27, commit 911e9de). Left open pending live confirmation and the remaining prompt=login/max_age work. Co-Authored-By: Claude Sonnet 5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 169987@bnt-lap001 Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999 --- intakes/intakes.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/intakes/intakes.md b/intakes/intakes.md index 6252ede..c9d2320 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -291,7 +291,7 @@ repo: informed-decision lane: blue tags: [cross-repo, authentication] created: '2026-09-16' -updated: '2026-09-16' +updated: '2026-09-27' description: >- Coordinate with key-cape and the Authelia deployment owner to validate an upgrade supporting prompt=login/max_age, including changed ID-token claims, @@ -304,6 +304,18 @@ description: >- prove the full browser path, not just redirect parameter forwarding. T03's three human approvals and key check subsequently completed; this is ongoing authentication reliability work, not an outstanding T03 execution. + + 2026-09-27: reproduced live — platform-root's attempt to approve + infd-20260927-b01 got policy_denied from flex-auth's compact_sitting + policy despite a just-completed MFA sign-in, matching this intake's + predicted failure exactly. Root cause confirmed and fixed in key-cape + (`ADHOC-2026-09-27`, commit 911e9de): completeAuthorization was reusing an + existing kc_login cookie's IssuedAt even on the two call sites that had + just validated an MFA token in that same request, backdating freshness. + Regression test added; full key-cape suite green. The prompt=login/max_age + and actionable-freshness-error parts of this intake remain open — do not + close until platform-root confirms a live approval succeeds against the + fixed key-cape build. state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08" ```