coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind portal OIDC workplan to State Hub

Browse source
This commit is contained in:
tegwick 2026-07-28 00:43:56 +02:00
parent 806bcf18d4
commit 76da0237ff
2 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -14,6 +14,7 @@
| workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| workplan | KEY-WP-0007 | active | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@ -63,3 +64,6 @@
| task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0007-T01 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0007-T02 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0007-T03 | progress | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |

4
workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
View file

@ -12,6 +12,7 @@ updated: "2026-07-27"
depends_on:
- KEY-WP-0005
- USER-WP-0020
state_hub_workstream_id: "92727f0c-09a8-4431-88c4-3cb6fe946d27"
---
# KEY-WP-0007 - User-engine portal OIDC relying-party integration
@ -26,6 +27,7 @@ not move user-domain or authorization ownership into KeyCape.
id: KEY-WP-0007-T01
status: done
priority: high
state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e"
```
Register `user-engine-portal` for authorization code with mandatory S256 PKCE,
@ -38,6 +40,7 @@ implicit flow, client secret, or dynamic registration is allowed.
id: KEY-WP-0007-T02
status: done
priority: high
state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928"
```
Update the railiance01 KeyCape configuration without exposing its signing key
@ -50,6 +53,7 @@ unregistered callback denial and successful token exchange through the portal.
id: KEY-WP-0007-T03
status: progress
priority: high
state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
```
Prove issuer, audience, tenant, groups, roles and assurance claims are verified