coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete identity seams and email login
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-29 23:14:09 +02:00
parent 7659397574
commit 487012e961
5 changed files with 122 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
View file

@ -38,7 +38,7 @@ before state migration or retirement begins.
```task
id: NK-WP-0022-T01
status: progress
status: done
priority: high
state_hub_task_id: "fe55a2c2-8613-4190-a0b9-07eff4a58146"
```
@ -71,6 +71,12 @@ database fingerprints. CoulombCore exposes PostgreSQL logical backups but no
matching LLDAP, Authelia, or privacyIDEA backup CronJobs; fresh protected
source backups remain a hard gate.
2026-07-29 closure review: the subsequent backup, migration, dependency and
conformance tasks used this inventory successfully. Every identity state set
now has an authority, protected rollback source and verification method; the
remaining public names are tracked explicitly under T06 or their owning
non-identity cutovers. Inventory contract complete.
## T02 - Prove recoverable backups before changing state
```task

21
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -65,7 +65,7 @@ disposable subject. Reconciliation, compensation, and drift reporting remain.
```task
id: NK-WP-0023-T03
status: progress
status: done
priority: high
state_hub_task_id: "76289890-6e6e-45ea-90dc-d3d58eee8b62"
```
@ -113,6 +113,17 @@ had no matching ingress. Commit `8e7229a` adds the namespace-and-pod-scoped
`:8080` rule plus verifier coverage. After applying it, an in-pod discovery
request from user-engine to KeyCape returns HTTP 200.
2026-07-29 complete: the live Binky browser flow verified the canonical
issuer/audience, Binky-only tenant/groups, tenant-admin role, AAL2
password-plus-OTP assurance, and denial of platform/Coulomb administration.
Password and MFA handoffs remain on NetKingdom-owned surfaces.
The live journey also exposed uid-only first-factor input. Authelia now uses
its documented LLDAP filter accepting either `uid` or `mail` while continuing
to resolve the stable uid identity. The updated ConfigMap passed server-side
validation and the restarted deployment is Ready without configuration
errors, so future users may enter either `bernd.worsch` or the full email.
## T04 - Integrate authorization, email, audit, and events
```task
@ -209,7 +220,7 @@ Administration of both `tenant:platform` and `tenant:coulomb` was denied.
```task
id: NK-WP-0023-T08
status: wait
status: done
priority: medium
state_hub_task_id: "7ef8e1f5-1a0e-4a34-9535-708e3146ae72"
```
@ -218,3 +229,9 @@ Document later adapters for customer IdPs/directories, SAML/OIDC federation,
SCIM, JIT provisioning, directory group mapping, customer-owned offboarding,
and conflict/freshness rules. Keep `NK-WP-0011` demand-triggered; this task
defines compatibility seams, not enterprise implementation.
2026-07-29: added
`docs/user-engine-enterprise-identity-extension-points.md`, covering OIDC/SAML
federation, SCIM, JIT, group mapping, provenance, source ownership,
conflict/freshness rules, offboarding, failure behavior, and demand triggers
without starting the demand-gated enterprise implementation.