From c12eb899b40e1ff0e6c1285d646b4c8c7f18e374 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 23:38:45 +0200 Subject: [PATCH] Sharpen NK-WP-0051 field names, opt-in page, and preview tool. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52 --- workplans/NK-WP-0051-sign-in-diagnosis.md | 43 +++++++++++++++++++---- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md index 7d504f7..2939088 100644 --- a/workplans/NK-WP-0051-sign-in-diagnosis.md +++ b/workplans/NK-WP-0051-sign-in-diagnosis.md @@ -5,11 +5,12 @@ title: "Show who a workload sign-in actually is" domain: infotech repo: net-kingdom status: ready -flavor: planning +flavor: implementation owner: codex topic_slug: netkingdom created: "2026-10-14" updated: "2026-10-14" +depends_on: [] related: - MASON-WP-0011 - NK-WP-0034 @@ -31,6 +32,12 @@ account site, Authelia, and OpenBao. The account site stayed on then said only `claim "groups" does not match any associated bound claim values`. A user with no one-time password never reached that refusal. +Done when an attended `bao login` with the T05 fixture uid shows, before +OpenBao answers, the uid, its group display names, and `aal2`; and the +ops-mason receipt for the refused login names the same uid and the OpenBao +error text. A routine login to a client that has not opted in gains no +extra screen. + ## Boundaries NetKingdom orchestrates this. It does not re-implement the issuer, the @@ -72,7 +79,18 @@ returns to the application, the KeyCape log line (`client_id` and uid), the account site (account-site uid and Authelia uid on separate lines), and the ops-mason receipt (uid and the OpenBao error text, no token). -Done when that document is the only copy of the field list. +Each fact has one field name, used unchanged on every surface: +`uid`, `groups` (sorted display names), `assurance` (`aal1` or `aal2`), plus +`client_id` and, on the receipt only, `openbao_error`. The document also +lists what never appears: tokens, authorization codes, email addresses, +one-time passwords, raw `memberOf` DNs, and session cookies. + +`assurance` describes this authorization request, from KeyCape's assurance +decision (`MFAVerified`). A reused session that was `aal2` earlier is `aal1` +here unless this request asked for and verified the one-time code. + +Done when that document is the only copy of the field list and the other +tasks link to it instead of restating it. ## KeyCape shows the principal before the callback @@ -87,7 +105,12 @@ state_hub_task_id: "a78219bb-2355-5a2e-8750-0b32a57f87bc" ``` key-cape shows the three facts before it redirects to the application, and -adds the uid and `client_id` to the existing auth log line. A groups +adds the uid and `client_id` to the existing auth log line. + +The page is opt-in per client (a client registration flag, default off), +enabled first for the OpenBao client. Routine logins elsewhere keep their +current flow. The page has one action, continue, and a line that says how +to sign in as someone else. A groups refusal from OpenBao then follows a screen that already named the uid. Acceptance is a deployed key-cape image. The log line contains no token, @@ -120,11 +143,17 @@ priority: high state_hub_task_id: "65f85a11-8512-5700-b258-feb2ead84372" ``` -Add a read-only preview in this repo that prints one uid's `memberOf` -display names. No mail, no password, no one-time password. Matching those -names to an OpenBao role stays a metadata read in ops-mason. +Add a read-only `groups --user ` operation to +`sso-mfa/k8s/lldap/lldap_admin.py`. It reuses the existing snapshot and +custody login, has no `--apply`, and prints the T01 fields `uid` and +`groups`. An unknown uid is a refusal, not an empty list. No mail, no +password, no one-time password. Tests extend +`tests/test_lldap_group_maintenance.py`; `GROUP-MAINTENANCE.md` documents +the command. Matching those names to an OpenBao role stays a metadata read +in ops-mason. -Name one negative-login fixture in the T01 document: a uid that is not in +Name one negative-login fixture in the T01 document (`signin-probe-negative`): +a uid that is not in `reuse-surface-hub-writers`, is not a platform admin, and will hold a one-time password. Do not create that user in git.