coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record suspended identity enforcement

Browse source
This commit is contained in:
tegwick 2026-07-28 01:33:24 +02:00
parent 909bb327fc
commit 070c38f447
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: netkingdom
created: "2026-07-27"
updated: "2026-07-27"
updated: "2026-07-28"
depends_on:
- KEY-WP-0005
- USER-WP-0020
@ -65,3 +65,9 @@ an unregistered callback with `invalid_profile_usage`. The portal begins an
S256 PKCE flow and hands authentication to Authelia. LLDAP tenant envelope
mapping now recognizes unambiguous `tenant:<kind>:<slug>:users|admins` groups;
ambiguous multi-tenant directory envelopes fail closed to no explicit tenant.
2026-07-28: suspension now fails closed at both token exchange and
`/userinfo`; the deployed `key-cape:909bb32` image refuses subjects carrying
the `netkingdom-suspended` directory group. The portal admin surface uses this
through the provider-neutral lifecycle API. The human Binky MFA/claims
acceptance remains the final part of this task.