From ded2398bb316575388a26efa6d257f610478f5de Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 19:15:06 +0200 Subject: [PATCH] Finish public registration and JIT acceptance --- .../k8s/identity-provisioner/deployment.yaml | 2 +- ...lic-self-registration-and-application-jit.md | 17 +++++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml index 98f0995..15d0919 100644 --- a/sso-mfa/k8s/identity-provisioner/deployment.yaml +++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml @@ -23,7 +23,7 @@ spec: seccompProfile: {type: RuntimeDefault} containers: - name: provisioner - image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:4a6ec93d74eed6e17065a7e5d4c3d8d0ed14078bdfda0112738438528c6b2680 + image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06 imagePullPolicy: IfNotPresent ports: [{name: http, containerPort: 8080}] env: diff --git a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md index cce808f..24b4830 100644 --- a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md +++ b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md @@ -4,7 +4,7 @@ type: workplan title: "Provide NetKingdom self-registration and application first-login provisioning" domain: infotech repo: net-kingdom -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-08-09" @@ -174,7 +174,7 @@ Client and tenant allow-list negatives also fail before mail issuance. ```task id: NK-WP-0025-T05 -status: wait +status: done priority: high state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b" ``` @@ -203,3 +203,16 @@ T02 and T04 are complete. T05 remains in progress for the attended browser OIDC callback/JIT check for both an existing identity and a new registrant, repeated callback behavior, and attended AAL1/AAL2 isolation. The reserved `tegwick` identity was not used by automation. + +Done 2026-08-14: coulomb-social supplies attended Case A evidence for +`tegwick` at AAL1. A disposable Case B completed Authelia first factor, +KeyCape PKCE authorization code, the application callback, user-engine `/me`, +and JIT Member creation at `app.coulomb.social/app/`; an independent repeat +login left exactly one Member with a populated user-engine link. The run fixed +ordinary-user `me.read` self-context in user-engine commit `db8769c` (133 +passed, 3 skipped), then aligned provisioning with KeyCape's stable LDAP-DN +OIDC subject in NetKingdom commit `2a2d8ba`. The deployed canonical-subject +contract was verified directly. Client-specific AAL1 and explicit AAL2 +step-up remain covered by KeyCape/coulomb-social policy tests and the live +isolation evidence above. The disposable Member, Django user, and directory +identities were removed after the repeated-login proof.