2.1 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | depends_on | state_hub_workstream_id | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0007 | workplan | User-engine portal OIDC relying-party integration | infotech | key-cape | active | codex | netkingdom | 2026-07-27 | 2026-07-27 |
|
92727f0c-09a8-4431-88c4-3cb6fe946d27 |
KEY-WP-0007 - User-engine portal OIDC relying-party integration
Register and prove the reusable user-engine portal as a strict KeyCape public
client. This is the authentication edge required by NK-WP-0023-T03; it does
not move user-domain or authorization ownership into KeyCape.
Register the static portal client
id: KEY-WP-0007-T01
status: done
priority: high
state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e"
Register user-engine-portal for authorization code with mandatory S256 PKCE,
exact callback URIs and only openid profile email groups. No wildcard,
implicit flow, client secret, or dynamic registration is allowed.
Deploy and verify the live client
id: KEY-WP-0007-T02
status: done
priority: high
state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928"
Update the railiance01 KeyCape configuration without exposing its signing key or backend credentials. Verify discovery, authorize redirect validation, unregistered callback denial and successful token exchange through the portal.
Prove claims and MFA isolation
id: KEY-WP-0007-T03
status: progress
priority: high
state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
Prove issuer, audience, tenant, groups, roles and assurance claims are verified by the portal and that tenant administration does not imply platform-root. Complete the Binky user/MFA acceptance through the reusable browser path.
2026-07-27: The live client accepts only the exact portal callback and rejects
an unregistered callback with invalid_profile_usage. The portal begins an
S256 PKCE flow and hands authentication to Authelia. LLDAP tenant envelope
mapping now recognizes unambiguous tenant:<kind>:<slug>:users|admins groups;
ambiguous multi-tenant directory envelopes fail closed to no explicit tenant.