tegwick
8d4336e944
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
1.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | related | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0033 | workplan | Preserve fresh-user authentication for the Vergabe company handoff | infotech | key-cape | active | codex | netkingdom | 2026-09-12 | 2026-09-12 |
|
Forward login freshness to the actual authentication provider
id: KEY-WP-0033-T01
status: done
priority: high
KeyCape parsed prompt=login and max_age but dropped them before Authelia. Forward these through the provider-neutral AuthRequest and the Authelia adapter. Absent values retain ordinary SSO behavior. Handler and adapter regressions cover forced login and zero/nonzero maximum age. Full Go suite passes after correcting the existing example-count regression: the example file already contains four service clients and the admitted human approver client.
Publish, preflight and prove the fresh recipient boundary
id: KEY-WP-0033-T02
status: todo
priority: high
Publish the exact source and validate current live config before replacing the single issuer instance. The live image is dcebd46/digest 7ff54c54; current main also contains startup validation and tenant provenance changes documented in docs/operations.md. Preserve all unrelated client, credential and MFA policy configuration. NK-WP-0037 adds the exact public Vergabe callback with no tenant assertion or MFA downgrade. Confirm prompt=login reaches Authelia through the live redirect, wrong callbacks and missing PKCE fail, and the actual recipient uses their own identity. Provider restart invalidates pending in-memory logins; USER-WP-0025-T03 still owns full provider sign-out coordination.