tegwick
153258b9d3
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 23s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
46 lines
1 KiB
Markdown
46 lines
1 KiB
Markdown
---
|
|
id: KEY-WP-0012
|
|
type: workplan
|
|
title: "Repair UserInfo canonical subject resolution"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: active
|
|
owner: codex
|
|
topic_slug: userinfo-canonical-subject-resolution
|
|
created: "2026-08-31"
|
|
updated: "2026-08-31"
|
|
---
|
|
|
|
## Repair subject lookup
|
|
|
|
```task
|
|
id: KEY-WP-0012-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Resolve the canonical LDAP-DN `sub` emitted by the token endpoint without
|
|
passing it to the username-only repository lookup. Preserve stable subject
|
|
semantics and verify any `preferred_username` lookup against the canonical ID.
|
|
|
|
## Regression verification
|
|
|
|
```task
|
|
id: KEY-WP-0012-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Cover canonical-ID, legacy username-sub, missing subject, and suspended-user
|
|
behavior. Run the KeyCape test suite and image build checks.
|
|
|
|
## Deploy and verify OpenBao OIDC
|
|
|
|
```task
|
|
id: KEY-WP-0012-T03
|
|
status: progress
|
|
priority: high
|
|
```
|
|
|
|
Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
|
|
fresh human access token, then resume the governed Policy Nexus bootstrap.
|