From 895de67a2d67d897b6ce8f2715b0a9fa9211d12f Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 27 Sep 2026 20:25:05 +0200 Subject: [PATCH] Record live confirmation of both key-cape login fixes (INFD-IN-0005) Platform-root confirmed a live approval of infd-20260927-b01 succeeded after the discovery-header fix (key-cape@8be8065) was deployed alongside the freshness fix (911e9de). Both defects this intake predicted/tracked are resolved and verified. Co-Authored-By: Claude Sonnet 5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 169987@bnt-lap001 Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999 --- intakes/intakes.md | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/intakes/intakes.md b/intakes/intakes.md index c9d2320..e0c71e1 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -312,10 +312,23 @@ description: >- (`ADHOC-2026-09-27`, commit 911e9de): completeAuthorization was reusing an existing kc_login cookie's IssuedAt even on the two call sites that had just validated an MFA token in that same request, backdating freshness. - Regression test added; full key-cape suite green. The prompt=login/max_age - and actionable-freshness-error parts of this intake remain open — do not - close until platform-root confirms a live approval succeeds against the - fixed key-cape build. + Regression test added; full key-cape suite green. + + Same rollout also surfaced a second, independent bug in the same code path: + the Authelia discovery/JWKS fetch used to verify upstream ID tokens never + carried the split-horizon X-Forwarded-Proto/Host headers that the token + exchange got in key-cape@3b0446e, so Authelia 4.38 failed closed on it and + no KeyCape login worked at all (not just informed-decision's). Fixed in + key-cape@8be8065 with its own regression test + (`TestDiscoveryFetch_CarriesPublicOriginHeaders`), deployed to `sso`. + + 2026-09-27 (later): platform-root confirmed a live approval of + infd-20260927-b01 succeeded in the browser after both key-cape fixes were + deployed. The freshness-backdating and discovery-header defects this intake + tracked are resolved and verified live. The prompt=login/max_age and + actionable-freshness-error parts of the original ask remain open — keep + this intake open for those, or split them into a fresh intake and close + this one; operator's call. state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08" ```