47 lines
1.7 KiB
Markdown
47 lines
1.7 KiB
Markdown
|
---
|
||
|
|
id: KEY-WP-0033
|
||
|
|
type: workplan
|
||
|
|
title: "Preserve fresh-user authentication for the Vergabe company handoff"
|
||
|
|
domain: infotech
|
||
|
|
repo: key-cape
|
||
|
|
status: active
|
||
|
|
owner: codex
|
||
|
|
topic_slug: netkingdom
|
||
|
|
created: "2026-09-12"
|
||
|
|
updated: "2026-09-12"
|
||
|
|
related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
|
||
|
|
---
|
||
|
|
|
||
|
|
## Forward login freshness to the actual authentication provider
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0033-T01
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
KeyCape parsed prompt=login and max_age but dropped them before Authelia.
|
||
|
|
Forward these through the provider-neutral AuthRequest and the Authelia adapter.
|
||
|
|
Absent values retain ordinary SSO behavior. Handler and adapter regressions
|
||
|
|
cover forced login and zero/nonzero maximum age. Full Go suite passes after
|
||
|
|
correcting the existing example-count regression: the example file already
|
||
|
|
contains four service clients and the admitted human approver client.
|
||
|
|
|
||
|
|
## Publish, preflight and prove the fresh recipient boundary
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: KEY-WP-0033-T02
|
||
|
|
status: todo
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Publish the exact source and validate current live config before replacing the
|
||
|
|
single issuer instance. The live image is dcebd46/digest 7ff54c54; current main
|
||
|
|
also contains startup validation and tenant provenance changes documented in
|
||
|
|
docs/operations.md. Preserve all unrelated client, credential and MFA policy
|
||
|
|
configuration. NK-WP-0037 adds the exact public Vergabe callback with no tenant
|
||
|
|
assertion or MFA downgrade. Confirm prompt=login reaches Authelia through the
|
||
|
|
live redirect, wrong callbacks and missing PKCE fail, and the actual recipient
|
||
|
|
uses their own identity. Provider restart invalidates pending in-memory logins;
|
||
|
|
USER-WP-0025-T03 still owns full provider sign-out coordination.
|