coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m27s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details

Browse source 
Authelia 4.38 refuses prompt=login for every real login because it registers
the authorization request after authentication. Send a bounded max_age
upstream and check the verified upstream auth_time against prompt=login /
max_age in the callback, failing closed when auth_time is missing.

Also update the service-client example count left stale by 651625c/1620ce2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
This commit is contained in:
tegwick 2026-09-23 21:59:21 +02:00
parent 9cb950752f
commit 11ce29af8b
7 changed files with 201 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/KEY-WP-0033-vergabe-fresh-login.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-09-12"
updated: "2026-09-12"
updated: "2026-09-23"
related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
state_hub_workstream_id: "144dd430-1a09-51e1-9aad-e799ee86c338"
---
@ -69,3 +69,20 @@ identity mappings and staff accounts. Native invited-user sign-in/MFA and
confirmation are now requested from the operator; no user credential was used
by the agent. Recovery and two-user acceptance remain their existing tasks.
Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
2026-09-23 regression from the attended recipient sign-in (net-kingdom message
ee4808e2, NK-WP-0037-T02): Authelia 4.38 registers the authorization request
only after the login, so forwarding prompt=login fails every real login ("auth_time
happened before the authorization request was registered"). The 2026-09-12
forwarding checks were redirect-only and never completed a login. Fix (owner
option a): KeyCape no longer sends prompt to Authelia. prompt=login and
max_age=0 travel as max_age=10, a shorter max_age is raised to 10, a longer one
passes through. KeyCape then enforces the exact requirement itself against the
verified upstream auth_time: prompt=login needs an authentication no earlier
than the KeyCape request, max_age needs one within that age, and a missing
auth_time fails closed (event `stale_upstream_authentication`). Known edge: a
user whose Authelia login is under 10s old at request time is not re-prompted
and is refused rather than admitted. Also fixed the stale example-count test left
by 651625c/1620ce2 (6 service + 1 human). Full Go suite passes. Not deployed:
needs a release plus the attended window, then a completed rerun of the
bernd.worsch-99 journey. Redirect-only checks do not count as proof.