b8dda4115a
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
57 lines
1.6 KiB
Markdown
57 lines
1.6 KiB
Markdown
---
|
|
id: KEY-WP-0012
|
|
type: workplan
|
|
title: "Repair UserInfo canonical subject resolution"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: userinfo-canonical-subject-resolution
|
|
created: "2026-08-31"
|
|
updated: "2026-09-01"
|
|
state_hub_workstream_id: "2aca83d8-4e80-52c6-8929-f1e957576b47"
|
|
---
|
|
|
|
## Repair subject lookup
|
|
|
|
```task
|
|
id: KEY-WP-0012-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "bc1ee2c7-a321-5914-96d1-9cb871f0ee1b"
|
|
```
|
|
|
|
Resolve the canonical LDAP-DN `sub` emitted by the token endpoint without
|
|
passing it to the username-only repository lookup. Preserve stable subject
|
|
semantics and verify any `preferred_username` lookup against the canonical ID.
|
|
|
|
## Regression verification
|
|
|
|
```task
|
|
id: KEY-WP-0012-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "7073cc30-a518-5c27-acaf-1a323fd981c6"
|
|
```
|
|
|
|
Cover canonical-ID, legacy username-sub, missing subject, and suspended-user
|
|
behavior. Run the KeyCape test suite and image build checks.
|
|
|
|
## Deploy and verify OpenBao OIDC
|
|
|
|
```task
|
|
id: KEY-WP-0012-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "571c5237-93fa-5c61-87af-974e02fd8929"
|
|
```
|
|
|
|
Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
|
|
fresh human access token, then resume the governed Policy Nexus bootstrap.
|
|
|
|
Completed 2026-09-01. Forgejo Actions run 14 built commit
|
|
`153258b9d39273d53ca7ab5d1bdc09961ea9026e`; image digest
|
|
`sha256:4c7193efc3e50bd72a01812a583e823cc04f41ca96ef387b31ba9ae2533b80d0`
|
|
rolled out successfully. A fresh OpenBao OIDC flow passed `/userinfo`, and the
|
|
governed Policy Nexus bootstrap subsequently completed with deterministic
|
|
session revocation.
|