coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish portal OIDC integration

Browse source
This commit is contained in:
tegwick 2026-07-29 22:59:38 +02:00
parent 6b32fb1384
commit a6ff5384b1
2 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
WORK-RECORDS.md
View file

@ -11,10 +11,10 @@
| workplan | KEY-WP-0001 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | workplan | KEY-WP-0001 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| workplan | KEY-WP-0002 | done | — | workplans/KEY-WP-0002-container-image-gitea.md | | workplan | KEY-WP-0002 | done | — | workplans/KEY-WP-0002-container-image-gitea.md |
| workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | workplan | KEY-WP-0004 | finished | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | | workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| workplan | KEY-WP-0007 | active | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md | | workplan | KEY-WP-0007 | finished | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@ -50,12 +50,12 @@
| task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T02 | progress | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T02 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T06 | cancel | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T06 | cancel | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T07 | wait | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T07 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0005-T01 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | | task | KEY-WP-0005-T01 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| task | KEY-WP-0005-T02 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | | task | KEY-WP-0005-T02 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| task | KEY-WP-0005-T03 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | | task | KEY-WP-0005-T03 | done | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
@ -66,4 +66,4 @@
| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0007-T01 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md | | task | KEY-WP-0007-T01 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0007-T02 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md | | task | KEY-WP-0007-T02 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
| task | KEY-WP-0007-T03 | progress | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md | | task | KEY-WP-0007-T03 | done | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |

14
workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "User-engine portal OIDC relying-party integration" title: "User-engine portal OIDC relying-party integration"
domain: infotech domain: infotech
repo: key-cape repo: key-cape
status: active status: finished
owner: codex owner: codex
topic_slug: netkingdom topic_slug: netkingdom
created: "2026-07-27" created: "2026-07-27"
updated: "2026-07-28" updated: "2026-07-29"
depends_on: depends_on:
- KEY-WP-0005 - KEY-WP-0005
- USER-WP-0020 - USER-WP-0020
@ -51,7 +51,7 @@ unregistered callback denial and successful token exchange through the portal.
```task ```task
id: KEY-WP-0007-T03 id: KEY-WP-0007-T03
status: progress status: done
priority: high priority: high
state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2" state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
``` ```
@ -71,3 +71,11 @@ ambiguous multi-tenant directory envelopes fail closed to no explicit tenant.
the `netkingdom-suspended` directory group. The portal admin surface uses this the `netkingdom-suspended` directory group. The portal admin surface uses this
through the provider-neutral lifecycle API. The human Binky MFA/claims through the provider-neutral lifecycle API. The human Binky MFA/claims
acceptance remains the final part of this task. acceptance remains the final part of this task.
2026-07-29 complete: the reusable browser path issued the Binky password
handoff, completed privacyIDEA TOTP enrollment, and returned through the
portal authorization-code flow. `/api/v1/me` verified the canonical issuer,
`user-engine-portal` audience, `tenant:friendly:binky`, Binky-only groups,
roles `user` + `tenant-admin`, and AAL2 assurance with `pwd` + `otp` and
`mfa: true`. The same session was denied administration of
`tenant:platform` and `tenant:coulomb`. All workplan tasks are complete.