coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Surface redacted directory bind failures before native onboarding
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Identity provider journey acceptance / provider (push) Successful in 6s
Details
Build and Publish identity-provisioner / build-and-push (push) Successful in 10s
Details

Browse source 
Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.

NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
This commit is contained in:
tegwick 2026-09-14 04:46:29 +02:00
parent d90e3b27f2
commit c8e07615c3
9 changed files with 554 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/NK-WP-0036-restore-user-portal-client-registration.md
View file

@ -8,7 +8,7 @@ status: active
owner: the-custodian
topic_slug: netkingdom
created: "2026-09-11"
updated: "2026-09-12"
updated: "2026-09-14"
related: [KEY-WP-0007, RAPPS-WP-0014, VERGABE-WP-0019]
state_hub_workstream_id: "6e1358d6-87e4-52e7-b3dd-09abdc48cefc"
---
@ -142,7 +142,7 @@ to export another live Secret. Retain NK-WP-0033's separate incident residuals.
```task
id: NK-WP-0036-T05
status: todo
status: progress
priority: high
state_hub_task_id: "46d33ab6-d76b-537f-8d60-32c4451675b5"
```
@ -156,6 +156,27 @@ single native onboarding journey. Preserve credential secrecy and avoid
unbounded password-check retries. Actual demo users and application admission
remain RAPPS-WP-0014 and VERGABE-WP-0019.
2026-09-14 agent implementation (not yet done): source now maps directory
HTTPError/URLError to redacted `{"error":"dependency_unavailable",
"dependency":"directory","reason":"auth_rejected|unreachable|protocol_error"}`.
`GET /healthz` remains process liveness; `GET /readyz` runs one login plus one
directory read. Auth rejection is cached for 30s so probes do not retry a
rejected password unbounded. 28 provider tests pass locally, including the new
directory-contract suite. identity-journeys CI discovers those tests;
identity-provisioner-image.yaml is the immutable publish lane.
Remaining operator steps before T05 can be marked done:
1. Push this commit to `main` so identity-journeys and identity-provisioner-image
run. Confirm journeys green, then record the image digest from
`coulomb/identity-provisioner`.
2. Pin that digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml`, switch
readiness to `/readyz` with `timeoutSeconds: 5` or higher, keep liveness on
`/healthz`, apply, and confirm Ready 1/1 with `/readyz` returning
`{"status":"ready","dependency":"directory"}`.
3. Verify one native onboarding journey: provider login, user create/linkage,
password setup. Do not retry a rejected password in a loop. Demo users and
application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
## Admit the canonical users hostname and preserve callback validation