From abc92a119707e6e1de7166af434ebe4c7afe9421 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 27 Jul 2026 22:30:02 +0200 Subject: [PATCH] Sequence identity portal before stack cutover --- ...tity-cutover-and-coulombcore-retirement.md | 11 +- ...user-engine-portal-platform-integration.md | 133 ++++++++++++++++++ 2 files changed, 143 insertions(+), 1 deletion(-) create mode 100644 workplans/NK-WP-0023-user-engine-portal-platform-integration.md diff --git a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md index a9bbef7..a43a346 100644 --- a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md +++ b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md @@ -4,11 +4,15 @@ type: workplan title: "Cut over NetKingdom identity to railiance01 and retire CoulombCore" domain: infotech repo: net-kingdom -status: ready +status: backlog owner: codex topic_slug: netkingdom created: "2026-07-27" updated: "2026-07-27" +depends_on: + - USER-WP-0020 + - NK-WP-0023 + - KEY-WP-0004 state_hub_workstream_id: "3dadddeb-4cec-48e2-9c2c-788b26dd6e93" --- @@ -25,6 +29,11 @@ railiance01, while Authelia, LLDAP, and privacyIDEA DNS still points to CoulombCore. Retirement is forbidden until state equivalence, end-to-end login, backup restoration, and an observed rollback window pass. +This cutover intentionally waits until the reusable user onboarding portal +completes the Binky tenant-admin flow. That supplies the human login/MFA and +lifecycle evidence needed to judge which identity stack is authoritative +before state migration or retirement begins. + ## T01 - Freeze the migration contract and inventory both stacks ```task diff --git a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md new file mode 100644 index 0000000..9f29f53 --- /dev/null +++ b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md @@ -0,0 +1,133 @@ +--- +id: NK-WP-0023 +type: workplan +title: "Integrate and deploy the user-engine onboarding portal" +domain: infotech +repo: net-kingdom +status: ready +owner: codex +topic_slug: netkingdom +created: "2026-07-27" +updated: "2026-07-27" +depends_on: + - USER-WP-0020 + - KEY-WP-0004 +--- + +# NK-WP-0023 - user-engine portal platform integration + +Provide the NetKingdom-owned adapters and production integration required by +`USER-WP-0020`, using the Binky tenant-admin onboarding from `KEY-WP-0004-T02` +as the first acceptance case. + +## T01 - Define source-of-truth and provisioning contracts + +```task +id: NK-WP-0023-T01 +status: todo +priority: high +``` + +Ratify lifecycle sequencing and compensation across user-engine, LLDAP, +KeyCape, privacyIDEA, flex-auth, email verification, audit, and outbox +delivery. user-engine owns user-domain and membership intent; NetKingdom IAM +owns credentials, authentication factors, coarse authentication claims, and +provider subjects. Define externally-provisioned/federated ownership metadata +now so later enterprise directories do not require a domain rewrite. + +## T02 - Implement the NetKingdom identity provisioning adapter + +```task +id: NK-WP-0023-T02 +status: wait +priority: high +``` + +Implement idempotent create/link/suspend/reactivate/deprovision operations for +the lightweight LLDAP + privacyIDEA stack behind user-engine's +`IdentityProvisioningPort`. Use scoped service identity and approved secret +transport. Never expose directory admin credentials to the browser or +user-engine domain. Add reconciliation, retry, compensation, and drift +reporting rather than assuming a distributed transaction. + +## T03 - Integrate KeyCape login, claims, and MFA handoffs + +```task +id: NK-WP-0023-T03 +status: wait +priority: high +``` + +Register the portal OIDC client with authorization code + PKCE, configure +callback/logout routes, verify issuer/audience/tenant/assurance claims, and +provide safe password and MFA enrollment/recovery handoffs. Preserve +platform-root separation and ensure tenant administration never implies +platform authority. + +## T04 - Integrate authorization, email, audit, and events + +```task +id: NK-WP-0023-T04 +status: wait +priority: high +``` + +Define and implement flex-auth resources/actions for self, tenant-admin, and +platform-admin operations; route verification/invitation email without making +mailbox ownership an authorization fact; correlate user-engine, IAM, +authorization, and platform audit records; and connect durable outbox +delivery with replay and dead-letter evidence. + +## T05 - Deploy on reef-railiance + +```task +id: NK-WP-0023-T05 +status: wait +priority: high +``` + +Package the portal as a managed platform workload on the default +`rail-kubernetes` path on `reef-railiance`, with Postgres, OpenBao-backed +runtime references, NetworkPolicies, TLS ingress, backups, observability, +resource limits, rollout/rollback, and availability evidence. Do not place +this stateful platform control surface on scale-to-zero Knative. + +## T06 - Prove role-scoped administration and failure safety + +```task +id: NK-WP-0023-T06 +status: wait +priority: high +``` + +Run end-to-end conformance for registration, login, MFA, tenant creation, +first-admin bootstrap, invitations, suspension/reactivation, cross-tenant +denial, platform-admin-only actions, provider outages, replay/idempotency, +backup restore, and reconciliation after partial failure. + +## T07 - Complete KEY-WP-0004 through the reusable portal + +```task +id: NK-WP-0023-T07 +status: wait +priority: high +``` + +Use the production portal to onboard +`bernd.worsch@binky-hedgehog.com` into `tenant:friendly:binky`, complete +OIDC/PKCE + MFA, and verify the Binky-only tenant-admin token and lifecycle +controls. Publish only non-secret evidence to `KEY-WP-0004-T02/T07`, then +finish that workplan. + +## T08 - Document enterprise integration extension points + +```task +id: NK-WP-0023-T08 +status: wait +priority: medium +``` + +Document later adapters for customer IdPs/directories, SAML/OIDC federation, +SCIM, JIT provisioning, directory group mapping, customer-owned offboarding, +and conflict/freshness rules. Keep `NK-WP-0011` demand-triggered; this task +defines compatibility seams, not enterprise implementation.