coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in sign-in diagnosis page and uid/assurance on auth log (NK-WP-0051-T02).

Browse source 
A client registration flag, signInDiagnosis (default off), makes the
callback render uid, sorted groups, assurance and client_id before the
redirect, with one continue link to the unchanged code. assurance is aal2
only when this request verified a one-time code. The auth_success log
line now carries uid and assurance beside client_id. Enabled for
openbao-admin in the dev config; the live flag is documented in
docs/operations.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-14 23:45:11 +02:00
parent 205a1c0edc
commit af3b1b0dfb
11 changed files with 376 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/operations.md
View file

@ -263,3 +263,15 @@ https://github.com/authelia/authelia/blob/v4.38.19/web/src/views/LoginPortal/Sig
Existing RP sessions and issued JWTs are not revoked. The original `/logout`
endpoint retains its local-only contract. Actual shared-session destruction
requires browser execution; a redirect-only smoke is not acceptance evidence.
## Sign-in diagnosis page (NK-WP-0051-T02)
A client with `signInDiagnosis: true` in its registration shows a page before
the redirect back to it: `uid`, `groups`, `assurance` and `client_id` as defined
in `net-kingdom/docs/sign-in-diagnosis.md`, with one continue link carrying the
unchanged code. Default is off. The repo enables it only for `openbao-admin` in
`config/dev-config.yaml`; the live flag is set by the config custody owner on the
OpenBao browser client in `config.yaml` of the `sso/keycape-config` Secret, and
takes effect on the next issuer restart. A redirect URI that is not http(s)
skips the page. Every `auth_success` log line now carries `client_id`, `uid` and
`assurance`, and no token, code, email or one-time password.