diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 3f72a76..19eabe4 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -132,7 +132,7 @@ | task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | -| task | NK-WP-0036-T04 | wait | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | task | NK-WP-0036-T05 | todo | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | diff --git a/docs/evidence/2026-09-11-native-portal-repair.md b/docs/evidence/2026-09-11-native-portal-repair.md index 80b8326..5652a80 100644 --- a/docs/evidence/2026-09-11-native-portal-repair.md +++ b/docs/evidence/2026-09-11-native-portal-repair.md @@ -60,3 +60,19 @@ seconds; Playwright opened temporary pages for previously visited origins. After the operator reported the repeated page activity, the helper was stopped and changed to cookie-only persistence. The confirmed tenant submission was not repeated. This was helper-induced UI disruption, not evidence of a tenant failure. + + +A subsequent Create login failed before directory creation because the provisioner's +LLDAP admin login returned 401. Reloading the old credential did not repair it. +The operator then ran the reviewed identity-provisioner-reconcile.py apply with +the current provider password entered only at its hidden terminal prompt. The +sanitized receipt confirms provider_login=true, consumer_login=true and +provider_password_changed=false. Secret UID c6a9e6be-5bb5-47e6-9faa-06b8d72afec3 +is unchanged; its resourceVersion advanced 51345775 to 60026132. + +Independent verification after the operator receipt returned reloaded-check-passed +for directory authentication and a directory read from the provisioner. Deployment +is ready 1/1 and retains image +sha256:5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06. +NK-WP-0036-T04 is complete. T05 retains structured dependency errors and functional +preflight; RAPPS-WP-0014 retains the actual native user login/password-setup proof. diff --git a/docs/identity-provisioner-bind-repair.md b/docs/identity-provisioner-bind-repair.md index 2a16d28..143c6b6 100644 --- a/docs/identity-provisioner-bind-repair.md +++ b/docs/identity-provisioner-bind-repair.md @@ -1,13 +1,13 @@ # Repair the identity provisioner's stored LLDAP credential -NK-WP-0036-T04, 2026-09-11. Prepared and tested; live apply has not run. +NK-WP-0036-T04, 2026-09-11. Attended live repair completed and independently verified. -The native User Engine Create login request reaches identity-provisioner, whose -LLDAP admin login returns HTTP 401 before identity creation. Reloading the +The native User Engine Create login request reached identity-provisioner, whose +LLDAP admin login returned HTTP 401 before identity creation. Reloading the existing lldap-secrets reference did not fix it. The tenant and user-domain records are independent and remain intact. Root portal login is working. -This is a proposed attended consumer-reference reconciliation. It does not +This procedure performs an attended consumer-reference reconciliation. It does not rotate the LLDAP account, change signing keys, restore an exposed predecessor, read a Secret payload, or rebuild KeyCape's configuration. The operator must supply the currently working LLDAP `admin` password from existing custody through @@ -34,7 +34,9 @@ python3 sso-mfa/k8s/lldap/identity-provisioner-reconcile.py check It authenticates the existing admin against the pinned in-cluster LLDAP URL and performs a directory read. It changes no provider or consumer state. -After explicit operator acceptance, use the UID/resourceVersion from inspect: +Use the current UID/resourceVersion from inspect. The following command records +the accepted and completed 2026-09-11 execution; its old resourceVersion will +now be refused: ```sh python3 sso-mfa/k8s/lldap/identity-provisioner-reconcile.py apply --expected-uid c6a9e6be-5bb5-47e6-9faa-06b8d72afec3 --expected-resource-version 51345775 @@ -52,8 +54,14 @@ restored. Other login services and the LLDAP provider are not restarted. Seven synthetic tests cover exact patch scope, stale metadata and controller refusal, candidate rejection before writes, check-only behavior, stdin-only value handling, redaction of child errors and the apply/reload/proof sequence. -The live metadata-only inspect succeeds. Live check/apply requires operator -input and is not claimed by those tests. +The operator subsequently supplied the working password only through the hidden +terminal prompt and completed apply. Its sanitized receipt reports result +reconciled, provider_login true, consumer_login true, and +provider_password_changed false. Secret UID is unchanged; resourceVersion is +now 60026132. Independent verification from the restarted consumer confirms +directory authentication plus a directory read. Deployment readiness is 1/1, +with its existing image digest 5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06. +No native user/password-setup completion is inferred from these service checks. After success, retry Create login only for the existing intended user, inspect the returned password-setup page and record the native identity linkage. diff --git a/workplans/NK-WP-0036-restore-user-portal-client-registration.md b/workplans/NK-WP-0036-restore-user-portal-client-registration.md index b1e550b..2c64596 100644 --- a/workplans/NK-WP-0036-restore-user-portal-client-registration.md +++ b/workplans/NK-WP-0036-restore-user-portal-client-registration.md @@ -113,10 +113,9 @@ identity activation and product accounts are retained in RAPPS-WP-0014-T02. ```task id: NK-WP-0036-T04 -status: wait +status: done priority: high -needs_human: true -intervention_note: "LLDAP rejects the provisioner's current admin login with 401 after reload. Prepared consumer-only reconciliation requires explicit operator acceptance and the current working LLDAP admin credential via hidden terminal input; never send it in chat." +needs_human: false state_hub_task_id: "3497d77a-1dc2-5fe6-8784-33949321f556" ``` @@ -130,8 +129,13 @@ The non-printing, field-only attended repair and seven synthetic tests are prepared at sso-mfa/k8s/lldap/identity-provisioner-reconcile.py. See docs/identity-provisioner-bind-repair.md for exact scope, operator input, metadata guard, candidate authentication, apply, reload and verification. -Live metadata inspect succeeds; live check/apply is pending current operator -custody and acceptance. The unresolved warden route is a pointer, not authority +The operator completed the hidden-input apply on 2026-09-11. Its sanitized +receipt confirms provider_login and consumer_login true, provider_password_changed +false, and the existing Secret resourceVersion advanced from 51345775 to +60026132. Independent consumer login plus directory-read verification returns +reloaded-check-passed; the deployment is ready 1/1 at its unchanged image. +The existing native user can now retry Create login; successful identity linkage +and password setup remain the pilot onboarding task. The unresolved warden route is a pointer, not authority to export another live Secret. Retain NK-WP-0033's separate incident residuals. ## Make dependency failure visible before another human onboarding attempt