diff --git a/capabilities/playbooks/key-cape.oidc-client-registration.yaml b/capabilities/playbooks/key-cape.oidc-client-registration.yaml deleted file mode 100644 index 6da37ca..0000000 --- a/capabilities/playbooks/key-cape.oidc-client-registration.yaml +++ /dev/null @@ -1,125 +0,0 @@ -apiVersion: netkingdom.io/playbook-capability/v0.1 -kind: PlaybookCapabilityDeclaration -metadata: - id: key-cape.oidc-client-registration - name: KeyCape OIDC client registration - owner: key-cape - repo: key-cape - domain: infotech - contract_version: "0.1" - source_links: - - label: Client field rules - path: spec/canonical-model.yaml - - label: First case request (Forgejo) - path: docs/forgejo-oidc-client-request.yaml - - label: Workplan - path: workplans/KEY-WP-0038-forgejo-oidc-client.md -spec: - playbook: - path: tools/keycape-client/ - type: cli-sequence - invocation: keycape-client register --client-file - description: >- - Idempotently add, update or remove exactly one client in the running - KeyCape client registry, without exporting secret values. Generalizes the - per-client helpers in net-kingdom sso-mfa/k8s/keycape (register-coulomb-social, - portal-client-rollout, vergabe-client-rollout, secrets-engine-openbao-client-rollout). - Modes: inspect, dry-run, apply, remove. - capabilities: - - id: c1.lightweight-sso - tier: C1 - resource_kinds: - - identities - - roles_scopes_policies - description: Register one OIDC relying party (browser or service) with the running lightweight issuer. - parameters: - - name: client_id - type: string - required: true - constraints: - pattern: ^[a-z0-9][a-z0-9-]{1,62}$ - sensitivity: operational - tuning_authority: netkingdom_tunable - description: OAuth2 client_id, unique in the registry. - - name: display_name - type: string - required: true - constraints: - pattern: ^[^\n\r]{1,80}$ - sensitivity: public - tuning_authority: netkingdom_tunable - description: Human-readable client name shown at sign-in. - - name: redirect_uris - type: string - required: true - constraints: - pattern: ^https://[^*\s,]+(,https://[^*\s,]+)*$ - sensitivity: security_sensitive - tuning_authority: netkingdom_tunable - description: Comma-separated exact redirect URIs; wildcards are never accepted. - - name: allowed_scopes - type: string - required: true - constraints: - pattern: ^openid(,(profile|email|groups))*$ - sensitivity: security_sensitive - tuning_authority: netkingdom_tunable - description: Comma-separated scopes the client may request; openid first. - - name: client_type - type: string - required: true - constraints: - pattern: ^(confidential|public)$ - sensitivity: security_sensitive - tuning_authority: netkingdom_tunable - description: confidential (server-side, holds a secret) or public (PKCE only). - - name: mfa_required - type: string - required: true - constraints: - pattern: ^(true|false)$ - sensitivity: security_sensitive - tuning_authority: netkingdom_tunable - description: Pin MFA on this client instead of relying on the provider default. - - name: secret_ref - type: string - required: false - constraints: - pattern: ^bao:[a-z0-9/_-]+$ - sensitivity: secret_reference - tuning_authority: netkingdom_tunable - description: Custody reference for a confidential client's secret, omitted for public clients; the registry reads the value from custody, never from the request. - responsibilities: - - resource_kind: identities - owner: key-cape - resources: - - oidc:static-clients - repo_owns: Registry change for exactly this client, field validation (KEY-WP-0028 rules), idempotency and removal. - netkingdom_orchestrates: Supply the case's validated, non-secret client fields. - - resource_kind: roles_scopes_policies - owner: key-cape - resources: - - iam-profile:client-scope-allowlists - repo_owns: Enforce exact redirect URIs, allowed scopes and the MFA pin at authorization time. - netkingdom_orchestrates: Choose scopes and MFA posture per SecurityCaseType. - trust: - requires: - - state: runtime_secret_trust - readiness_checks: [] - - state: runtime_identity_trust - readiness_checks: [] - satisfies: - - state: tenant_onboarding_trust - readiness_checks: - - id: client-authorize-accepts-registered-redirect - description: The authorization endpoint accepts the client with each registered redirect URI. - evidence: GET /authorize with client_id and each redirect_uri returns the login page, not an error. - - id: client-authorize-refuses-other-redirect - description: The authorization endpoint refuses an unregistered redirect URI for the client. - evidence: GET /authorize with an unregistered redirect_uri returns an OAuth error. - catalog: - publish: capabilities/playbooks/key-cape.oidc-client-registration.yaml - maturity: planned - consumers: - - netkingdom-security-scenario-composer - - netkingdom-security-case-types diff --git a/workplans/KEY-WP-0038-forgejo-oidc-client.md b/workplans/KEY-WP-0038-forgejo-oidc-client.md index 271afda..ef79d9b 100644 --- a/workplans/KEY-WP-0038-forgejo-oidc-client.md +++ b/workplans/KEY-WP-0038-forgejo-oidc-client.md @@ -104,9 +104,9 @@ state_hub_task_id: "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30" Registration is the first case of the SecurityCaseType `oidc-browser-relying-party` (net-kingdom NK-WP-0048, canon `security-case-types_v0.1`). The parameters accepted in T01 become the case; ops-mason materializes it (MASON-WP-0010) and -ops-warden follows through (WARDEN-WP-0044). key-cape's part is to declare -client registration as a playbook capability that the type composes, and to -review the type's composition. +ops-warden follows through (WARDEN-WP-0044). The registration capability is +net-kingdom's (`net-kingdom.keycape-client-registration`); key-cape's part is its +field rules and reviewing the type's composition. The original intent below still describes what must result. @@ -143,13 +143,21 @@ recorded. Then hand over to RAPPS-WP-0016. ```task id: KEY-WP-0038-T04 -status: todo +status: cancel priority: high state_hub_task_id: "583cf1f1-16dc-515f-83bc-1efc45024a89" ``` ### T04 — Implement the `keycape-client` entry point +**Cancelled 2026-10-08: moved to net-kingdom NK-WP-0048-T09 (done).** The live +registration machinery (contained kubectl, cluster and issuer pins) already lives +in net-kingdom `sso-mfa/k8s/keycape/`, where KeyCape is deployed; a copy here +would drift. The entry point is `net-kingdom/sso-mfa/k8s/keycape/keycape-client.py` +and the declaration is `net-kingdom.keycape-client-registration`; key-cape's draft +declaration is removed. key-cape still owns the client field rules (canonical +model) and their enforcement at authorization time. + `capabilities/playbooks/key-cape.oidc-client-registration.yaml` (contract PASS, `maturity: planned`) declares client registration as a playbook capability, so that the SecurityCaseType `oidc-browser-relying-party` (net-kingdom NK-WP-0048)