From 070c38f447f97b9fbce9750e83cde183388bf09a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 28 Jul 2026 01:33:24 +0200 Subject: [PATCH] Record suspended identity enforcement --- workplans/KEY-WP-0007-user-engine-portal-oidc-client.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md index 27a180d..8198683 100644 --- a/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md +++ b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-07-27" -updated: "2026-07-27" +updated: "2026-07-28" depends_on: - KEY-WP-0005 - USER-WP-0020 @@ -65,3 +65,9 @@ an unregistered callback with `invalid_profile_usage`. The portal begins an S256 PKCE flow and hands authentication to Authelia. LLDAP tenant envelope mapping now recognizes unambiguous `tenant:::users|admins` groups; ambiguous multi-tenant directory envelopes fail closed to no explicit tenant. + +2026-07-28: suspension now fails closed at both token exchange and +`/userinfo`; the deployed `key-cape:909bb32` image refuses subjects carrying +the `netkingdom-suspended` directory group. The portal admin surface uses this +through the provider-neutral lifecycle API. The human Binky MFA/claims +acceptance remains the final part of this task.