47 lines
1 KiB
Markdown
47 lines
1 KiB
Markdown
|
---
|
||
|
|
id: KEY-WP-0012
|
||
|
|
type: workplan
|
||
|
|
title: "Repair UserInfo canonical subject resolution"
|
||
|
|
domain: infotech
|
||
|
|
repo: key-cape
|
||
|
|
status: active
|
||
|
|
owner: codex
|
||
|
|
topic_slug: userinfo-canonical-subject-resolution
|
||
|
|
created: "2026-08-31"
|
||
|
|
updated: "2026-08-31"
|
||
|
|
---
|
||
|
|
|
||
|
|
## Repair subject lookup
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0012-T01
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Resolve the canonical LDAP-DN `sub` emitted by the token endpoint without
|
||
|
|
passing it to the username-only repository lookup. Preserve stable subject
|
||
|
|
semantics and verify any `preferred_username` lookup against the canonical ID.
|
||
|
|
|
||
|
|
## Regression verification
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0012-T02
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Cover canonical-ID, legacy username-sub, missing subject, and suspended-user
|
||
|
|
behavior. Run the KeyCape test suite and image build checks.
|
||
|
|
|
||
|
|
## Deploy and verify OpenBao OIDC
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0012-T03
|
||
|
|
status: progress
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
|
||
|
|
fresh human access token, then resume the governed Policy Nexus bootstrap.
|