coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Map explicit tenant groups into OIDC claims
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 26s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 00:34:19 +02:00
parent 993a4dd589
commit e8b4eded88
3 changed files with 96 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
View file

@ -24,7 +24,7 @@ not move user-domain or authorization ownership into KeyCape.
```task
id: KEY-WP-0007-T01
status: progress
status: done
priority: high
```
@ -36,7 +36,7 @@ implicit flow, client secret, or dynamic registration is allowed.
```task
id: KEY-WP-0007-T02
status: wait
status: done
priority: high
```
@ -48,10 +48,16 @@ unregistered callback denial and successful token exchange through the portal.
```task
id: KEY-WP-0007-T03
status: wait
status: progress
priority: high
```
Prove issuer, audience, tenant, groups, roles and assurance claims are verified
by the portal and that tenant administration does not imply platform-root.
Complete the Binky user/MFA acceptance through the reusable browser path.
2026-07-27: The live client accepts only the exact portal callback and rejects
an unregistered callback with `invalid_profile_usage`. The portal begins an
S256 PKCE flow and hands authentication to Authelia. LLDAP tenant envelope
mapping now recognizes unambiguous `tenant:<kind>:<slug>:users|admins` groups;
ambiguous multi-tenant directory envelopes fail closed to no explicit tenant.