coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Accept the account-site session lines (NK-WP-0051-T03 done).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Records the user-engine digest and that Authelia's authentication_level
is not assurance, since KeyCape checks the one-time code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 05:22:52 +02:00
parent deedca52a4
commit c19eabc4ae
3 changed files with 10 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/sign-in-diagnosis.md
View file

@ -25,6 +25,11 @@ authorization request and no earlier one**.
`aal1` here unless this request asked for and verified the one-time code.
Enrolling a factor is not `aal2`.
Authelia's own `authentication_level` is not `assurance`. KeyCape checks the
one-time code through privacyIDEA, so Authelia reports level 1 even for an
`aal2` sign-in. Surfaces take `assurance` from KeyCape (the request or the
token it issued), never from Authelia's `/api/state`.
## Never shown or logged
Tokens (ID, access, refresh, OpenBao), authorization codes, email
@ -38,7 +43,7 @@ not secret.
| --- | --- | --- | --- |
| KeyCape page before the redirect to the application. Opt-in per client (registration flag, default off), enabled first for the OpenBao client. One action: continue, plus how to sign in as someone else | `uid`, `groups`, `assurance`, `client_id` | key-cape | NK-WP-0051-T02 |
| The existing KeyCape auth log line | `client_id`, `uid`, `assurance` | key-cape | NK-WP-0051-T02 |
| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session) | user-engine | NK-WP-0051-T03 |
| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session), `assurance` of the account-site session | user-engine | NK-WP-0051-T03 |
| `lldap_admin.py groups --user <uid>` (read-only preview) | `uid`, `groups` | net-kingdom | NK-WP-0051-T04 |
| ops-mason verifier receipt for an attended `bao login` | `uid`, `openbao_error` (and `assurance` when known) | ops-mason | NK-WP-0051-T06 |
@ -63,6 +68,6 @@ OpenBao groups refusal.
| Item | Value |
| --- | --- |
| key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 → 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed |
| user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 |
| user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root · aal2` and Authelia `platform-root` |
| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |