coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record platform-root authorization fix

Browse source
This commit is contained in:
tegwick 2026-07-29 21:33:37 +02:00
parent 90a20783e5
commit 72b0eb404c
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -156,6 +156,13 @@ directory login, replay denial, and cleanup. This task now awaits only the
Binky user's own password choice, MFA enrollment, and final scoped-token Binky user's own password choice, MFA enrollment, and final scoped-token
acceptance. acceptance.
2026-07-29: the first portal attempt correctly denied cross-tenant access
because KeyCape had not projected the established `net-kingdom-admins` group
to the new platform-operator role. Commit `90a2078` adds and tests the explicit
`tenant:platform` / `platform-operator` compatibility mapping and is deployed
Ready. The operator must start a fresh OIDC session so the corrected claims
are minted.
## Task: Register a workload-identity OIDC client for the qonto runtime ## Task: Register a workload-identity OIDC client for the qonto runtime
```task ```task