key-cape/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
KEY-WP-0008	workplan	Registration handoff and client-aware MFA policy	infotech	key-cape	active	codex	netkingdom	2026-08-09	2026-08-09	NK-WP-0025	70b78f21-be6d-4d6c-a537-037c38b2884a

KEY-WP-0008 - registration handoff and client-aware MFA

Let a registered OIDC client offer NetKingdom signup and request step-up without making KeyCape an account store or weakening high-assurance clients.

T01 - Add a safe registration handoff

id: KEY-WP-0008-T01
status: done
priority: high
state_hub_task_id: "31627b02-4300-4f11-a8bb-8ff2bebb9566"

Define an allow-listed registration URL for eligible clients and preserve client ID, redirect URI, PKCE intent, tenant hint, and return context in a signed, expiring state envelope. Registration completion must restart the normal authorization flow and must not mint a token directly.

Done when unknown users can choose signup from an eligible authorization flow without open redirect, client substitution, or state replay.

T02 - Replace global MFA with client-aware minimum assurance

id: KEY-WP-0008-T02
status: progress
priority: high
state_hub_task_id: "c2b56182-e717-4ca3-84e3-0963b69ce32f"

Replace the single require-for-all switch with policy that combines client minimum assurance, requested ACR/step-up, tenant policy, protected action, and current session assurance. Preserve mandatory MFA for platform/admin clients. Allow coulomb-social ordinary login at password assurance when no stronger rule applies.

Done when one low-assurance client cannot suppress MFA for another client or reuse an under-assured session for a high-assurance request.

Implemented with nullable per-client mfaRequired: an explicit client value overrides the provider default only for that client. Absent values preserve the existing provider-driven policy.

T03 - Support explicit step-up and fresh authentication

id: KEY-WP-0008-T03
status: done
priority: high
state_hub_task_id: "bfa56396-1b94-4404-a4d5-fc5b4ae2b8e8"

Implement supported ACR/max-age or equivalent IAM Profile parameters, invoke privacyIDEA only when policy requires it, and return verifiable assurance claims. Handle users without an enrolled factor through a safe enrollment handoff rather than an authorization bypass.

Done when coulomb.social can request MFA for a profile/action and verify the result from token claims.

Implemented acr_values preservation and AAL2/MFA forcing through the privacyIDEA challenge. The existing token assurance claim reports aal2 and mfa: true only after successful verification.

T04 - Prove policy isolation and compatibility

id: KEY-WP-0008-T04
status: todo
priority: high
state_hub_task_id: "d4208f77-f4a6-4f2e-a436-de4f779cfaca"

Test known and unknown users, registration link eligibility, state expiry and replay, password-only coulomb-social login, profile/action step-up, no-factor enrollment, OpenBao mandatory MFA, cross-client session reuse, and logout. Keep static client registration and exact redirect rules unchanged.

Done when existing high-assurance clients pass unchanged and the new coulomb-social journey passes live.