coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Accept the account-site session lines (NK-WP-0051-T03 done).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Records the user-engine digest and that Authelia's authentication_level
is not assurance, since KeyCape checks the one-time code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 05:22:52 +02:00
parent deedca52a4
commit c19eabc4ae
3 changed files with 10 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.custodian-brief.md
View file

@ -2,7 +2,7 @@
# Custodian Brief — net-kingdom
**Domain:** infotech
**Last synced:** 2026-10-14 22:26 UTC
**Last synced:** 2026-10-14 22:34 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
@ -70,11 +70,9 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
*(wait: The next types follow once the first one is proven end to end.)*
### Show who a workload sign-in actually is
Progress: 2/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
Progress: 3/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
**Open tasks:**
- ! KeyCape shows the principal before the callback `a78219bb`
*(wait: Implemented in key-cape af3b1b0 (KEY-WP-0041). Image cdec9dd7 and the openbao-admin signInDiagnosis flag are live (2026-10-15). Waits for one attended OpenBao login that shows the page.)*
- ! Account site shows both sessions `bdc8b414`
*(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)*
- ! Enroll the negative-login factor `afb5816f`

9
docs/sign-in-diagnosis.md
View file

@ -25,6 +25,11 @@ authorization request and no earlier one**.
`aal1` here unless this request asked for and verified the one-time code.
Enrolling a factor is not `aal2`.
Authelia's own `authentication_level` is not `assurance`. KeyCape checks the
one-time code through privacyIDEA, so Authelia reports level 1 even for an
`aal2` sign-in. Surfaces take `assurance` from KeyCape (the request or the
token it issued), never from Authelia's `/api/state`.
## Never shown or logged
Tokens (ID, access, refresh, OpenBao), authorization codes, email
@ -38,7 +43,7 @@ not secret.
| --- | --- | --- | --- |
| KeyCape page before the redirect to the application. Opt-in per client (registration flag, default off), enabled first for the OpenBao client. One action: continue, plus how to sign in as someone else | `uid`, `groups`, `assurance`, `client_id` | key-cape | NK-WP-0051-T02 |
| The existing KeyCape auth log line | `client_id`, `uid`, `assurance` | key-cape | NK-WP-0051-T02 |
| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session) | user-engine | NK-WP-0051-T03 |
| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session), `assurance` of the account-site session | user-engine | NK-WP-0051-T03 |
| `lldap_admin.py groups --user <uid>` (read-only preview) | `uid`, `groups` | net-kingdom | NK-WP-0051-T04 |
| ops-mason verifier receipt for an attended `bao login` | `uid`, `openbao_error` (and `assurance` when known) | ops-mason | NK-WP-0051-T06 |
@ -63,6 +68,6 @@ OpenBao groups refusal.
| Item | Value |
| --- | --- |
| key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 → 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed |
| user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 |
| user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root · aal2` and Authelia `platform-root` |
| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |

4
workplans/NK-WP-0051-sign-in-diagnosis.md
View file

@ -124,10 +124,8 @@ the T01 document.
```task
id: NK-WP-0051-T03
status: wait
status: done
depends_on: [NK-WP-0051-T01]
blocked_on: message-from:user-engine
blocking_reason: "Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check."
priority: high
state_hub_task_id: "bdc8b414-94fe-52cb-8e26-85c9914d4068"
```