From 59c1df71e3dd08740fc2e4b81b9a84908d342967 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 15 Oct 2026 00:25:23 +0200 Subject: [PATCH] Record the live openbao-admin signInDiagnosis flag (KEY-WP-0041-T02). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52 --- .custodian-brief.md | 14 +++++++------- docs/operations.md | 8 +++++--- workplans/KEY-WP-0041-sign-in-diagnosis-page.md | 7 ++++--- 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 16b219c..c4ec082 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,11 @@ # Custodian Brief — key-cape **Domain:** infotech -**Last synced:** 2026-10-14 21:46 UTC +**Last synced:** 2026-10-14 22:10 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02) -Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b` - -**Open tasks:** -- · Deploy the image and record its digest `bd5db26c` - ### Negative-check tokens for the secrets-engine OpenBao JWT role Progress: 2/3 done | workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86` @@ -36,6 +30,12 @@ Progress: 2/4 done | workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9` - ! T02 — Register the client and hand over its secret `40ddaa29` *(wait: Claims are verified against the registered client.)* +### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02) +Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b` + +**Open tasks:** +- ► Deploy the image and record its digest `bd5db26c` + ## Inbox Hygiene **Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. diff --git a/docs/operations.md b/docs/operations.md index fbfd31e..3092a16 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -274,8 +274,10 @@ A client with `signInDiagnosis: true` in its registration shows a page before the redirect back to it: `uid`, `groups`, `assurance` and `client_id` as defined in `net-kingdom/docs/sign-in-diagnosis.md`, with one continue link carrying the unchanged code. Default is off. The repo enables it only for `openbao-admin` in -`config/dev-config.yaml`; the live flag is set by the config custody owner on the -OpenBao browser client in `config.yaml` of the `sso/keycape-config` Secret, and -takes effect on the next issuer restart. A redirect URI that is not http(s) +`config/dev-config.yaml`; the live flag is set on the OpenBao browser client +(`openbao-admin`) in `config.yaml` of the `sso/keycape-config` Secret, and takes +effect on the next issuer restart. It is live since 2026-10-15 (rv 75372162), +set with net-kingdom `sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py`; +`--operation remove` plus a restart is the rollback. A redirect URI that is not http(s) skips the page. Every `auth_success` log line now carries `client_id`, `uid` and `assurance`, and no token, code, email or one-time password. diff --git a/workplans/KEY-WP-0041-sign-in-diagnosis-page.md b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md index 4182253..80a6060 100644 --- a/workplans/KEY-WP-0041-sign-in-diagnosis-page.md +++ b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md @@ -57,6 +57,7 @@ evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing session: deployment needs operator approval. 2026-10-15: image `sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` -(source `8c6c071`) is live; see `docs/operations.md`. Remaining: set -`signInDiagnosis: true` on the OpenBao browser client in `sso/keycape-config` -and restart the issuer. Until then the page is off for every client. +(source `8c6c071`) is live; see `docs/operations.md`. 2026-10-15: `signInDiagnosis: true` set on `openbao-admin` with +net-kingdom `openbao-signin-diagnosis-rollout.py` (rv 71655453 → 75372162, +unrelated bytes preserved) and the issuer restarted; pod ready, discovery 200. +Remaining: one attended OpenBao login shows the page.