coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare pinned company-welcome and shared-issuer rollout patches
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 02:53:55 +02:00
parent 3db3eae394
commit ff1b25f515
3 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml Normal file
View file

@ -0,0 +1,9 @@
spec:
template:
spec:
containers:
- name: provisioner
image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6
env:
- name: PASSWORD_SETUP_TENANT_RETURNS
value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'

6
sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml Normal file
View file

@ -0,0 +1,6 @@
spec:
template:
spec:
containers:
- name: keycape
image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a

15
workplans/NK-WP-0037-vergabe-company-welcome.md
View file

@ -10,6 +10,7 @@ topic_slug: netkingdom
created: "2026-09-12"
updated: "2026-09-12"
related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
state_hub_workstream_id: "15f59624-ab25-5894-9b05-1e6b261749e5"
---
## Keep the company return inside the one-use setup grant
@ -18,6 +19,7 @@ related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
id: NK-WP-0037-T01
status: done
priority: high
state_hub_task_id: "61f71d46-8218-5c50-8b1b-5cd1c096d9d3"
```
PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies
@ -35,8 +37,10 @@ Existing setup links remain process-local and expire on restart.
```task
id: NK-WP-0037-T02
status: todo
status: wait
blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
priority: high
state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
```
Register public client vergabe-demo-company with only openid/profile/groups,
@ -54,3 +58,12 @@ setter, credential references and directory contents. Recipient sign-in and
provider-required MFA need an attended acceptance; no credential capture or
operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and
RAPPS-WP-0014 retains application placement and recovery.
2026-09-12 release prepared: source 48a75b1, published provisioner digest
sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6.
Sixteen tests pass against that runtime image. The exact public client helper's
server dry run passes with unrelated Secret/config bytes preserved; candidate
patches are in the KeyCape and provisioner directories. Deployment waits for
the attended shared-issuer window. See
railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration,
credential, recipient data or application session was changed.