coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Define user-engine portal integration boundary
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source
This commit is contained in:
tegwick 2026-07-27 22:48:58 +02:00
parent b56dbffd79
commit 9d1ae01b75
2 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

34
docs/user-engine-provisioning-contract.md Normal file
View file

@ -0,0 +1,34 @@
# user-engine identity provisioning contract
user-engine is authoritative for user, tenant membership and lifecycle intent.
NetKingdom is authoritative for provider subjects, credentials, password
policy, MFA factors and authentication sessions. KeyCape projects verified
authentication facts; flex-auth decides whether an actor may change intent.
The NetKingdom adapter implements user-engine's provider-neutral
`IdentityProvisioningPort`. Every operation has an idempotency key and
correlation ID. Provisioning creates or links an LLDAP subject, initializes
privacyIDEA eligibility without enrolling a factor, and returns the external
subject. Password and factor enrollment remain user-facing KeyCape handoffs.
Lifecycle order is:
1. Commit user-engine intent and an outbox event atomically.
2. Claim the event and call the provider with its stable idempotency key.
3. Store the provider subject and completion evidence.
4. Retry ambiguous failures; reconcile provider and domain state periodically.
Suspension disables provider authentication before reporting external
completion. Reactivation preserves the same subject. Deprovisioning first
removes active sessions and factors, then tombstones or removes the directory
subject according to retention policy. A failed downstream action remains
retryable and visible; it never rolls back authoritative audit history.
The adapter receives scoped provider credentials only through runtime secret
references. Neither browsers nor the user-engine domain receive directory,
MFA, KeyCape or mail-administration credentials.
Externally managed identities record provider, immutable external subject,
ownership (`platform` or `customer`), provisioning mode (`managed`,
`federated`, or `jit`), and last-observed freshness. Future SCIM and corporate
directory adapters use the same lifecycle results and conflict rules.

4
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -25,7 +25,7 @@ as the first acceptance case.
```task ```task
id: NK-WP-0023-T01 id: NK-WP-0023-T01
status: todo status: done
priority: high priority: high
state_hub_task_id: "8d96aa5e-9801-4d76-9140-d6076a4f2942" state_hub_task_id: "8d96aa5e-9801-4d76-9140-d6076a4f2942"
``` ```
@ -41,7 +41,7 @@ now so later enterprise directories do not require a domain rewrite.
```task ```task
id: NK-WP-0023-T02 id: NK-WP-0023-T02
status: wait status: progress
priority: high priority: high
state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350" state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350"
``` ```