97 commits

Author	SHA1	Message	Date
tegwick	9781102e29	Deploy KeyCape canonical subject fix ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663	2026-09-01 00:03:08 +02:00
tegwick	4a38511d11	fix(privacyidea): repair the resolver reconciliation script (NK-WP-0033) ... reconcile-lldap-resolver-live.sh had never completed a run. Four defects, found by running it on 2026-08-27: 1. request() set Content-Type: application/json on every call, including bodyless GETs. Werkzeug 3.x rejects those in front of privacyIDEA, so every GET returned an HTML 400 while POSTs succeeded — the resolver write landed and the lookup immediately after it did not. bootstrap-realm.sh already fixed this in pi_api and said why; this script was written later and did not inherit it. 2. GET /user/ returns result.value as a list of user objects, not a dict carrying "users". With the 400 fixed, the lookup finally reached the parse and raised AttributeError past the except clause, so the run died as a traceback instead of a receipt. Both shapes now accepted, and the except clause catches parse errors so a failed run still names the phase it died in. 3. A resolver write replaces the whole object, so TIMEOUT, CACHE_TIMEOUT and SIZELIMIT were dropped by every --apply. A resolver with them unset still resolves users, but the WebUI refuses to save or test it — so the script silently un-repaired a resolver an operator had fixed by hand. Now sent, defaulting to the verified 5/120/500 and overridable per run. Same omission fixed in bootstrap-realm.sh, which created the resolver that way originally. 4. The predecessor prompt could not be left empty, so an operator who had lost the exposed credential had to type a placeholder — which also fails the bind and was recorded as a PASSING denial proof. --predecessor-unavailable skips the bind and records NOT-PROVEN. --note carries operator context into the receipt line itself, so the claim and its caveat travel together. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166	2026-08-27 22:20:03 +02:00
codex	80c3a76431	chore: commit work in progress before registrar reconciliation ... Refs CUST-WP-0068 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 19:53:36 +02:00
tegwick	5b0a521c9a	NK-WP-0033 add attended resolver reconciliation receipt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 15:18:29 +02:00
tegwick	f2e578cf3e	feat(privacyidea): add guarded resolver reconciliation helper ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:43:39 +02:00
tegwick	c956ceba19	fix(authelia): load rotated client verifier from secret file ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:39:32 +02:00
tegwick	61aeafef71	feat(NK-WP-0032): admit OpenBao operator loopback callback ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:01:57 +02:00
tegwick	4a915ce6c7	NK-WP-0026 finished: user-engine caller identity verified live against railiance01 ... T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:01:12 +02:00
tegwick	f4f885289e	docs: point user-engine apply home at rapp-user-engine	2026-08-18 12:39:24 +02:00
tegwick	ded2398bb3	Finish public registration and JIT acceptance	2026-08-14 19:15:06 +02:00
tegwick	2a2d8ba055	Align provisioned identities with OIDC subjects	2026-08-14 18:53:37 +02:00
tegwick	94f27cb546	Complete live registration acceptance	2026-08-14 17:39:08 +02:00
tegwick	c56465e32d	Enable public registration and prove event delivery	2026-08-14 00:42:14 +02:00
tegwick	dbbccc1a80	Deploy scoped user-engine delivery lanes	2026-08-13 17:34:29 +02:00
tegwick	96266b9371	Resume user-engine integration rollout	2026-08-13 14:56:53 +02:00
tegwick	20d4d8af04	Allow user-engine egress to email-connect; record T04 hand-back. ... NetworkPolicy egress to email-connect:8080 for transactional invitation send; NK-WP-0024 note points at EMAIL-WP-0004 failure evidence.	2026-08-12 13:32:11 +02:00
tegwick	4511a43f7a	Wire user-engine authorization runtime	2026-08-10 19:15:18 +02:00
tegwick	dfdd3163b7	Deploy registration-aware identity provisioner	2026-08-10 15:49:34 +02:00
tegwick	83508915db	Register app.coulomb.social OIDC redirect for coulomb-social ... Parallel public host while apex stays Bubble; keep apex redirect for later.	2026-08-09 23:20:30 +02:00
tegwick	0e3a24d888	Deploy KeyCape client MFA override for coulomb-social ... Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration.	2026-08-09 22:42:51 +02:00
tegwick	0165ac8d14	Deploy user-engine flex-auth policy service	2026-08-09 02:21:41 +02:00
tegwick	27656916db	Add KeyCape client registration for coulomb.social ... Idempotent patch of sso/keycape-config with public PKCE client and redirect URIs for local :8008 and production coulomb.social callbacks.	2026-08-09 01:50:52 +02:00
tegwick	62b1ea3d59	Deploy tenant authority for user portal	2026-08-09 01:39:57 +02:00
tegwick	03cc0c5a91	Deploy expanded user-engine portal	2026-08-08 23:18:29 +02:00
tegwick	0ec6f8c75d	Move identity secret stores to local OpenBao	2026-08-03 21:37:17 +02:00
tegwick	39b71d6d96	Complete user-engine runtime custody	2026-07-30 00:40:43 +02:00
tegwick	f854969a01	Move portal workloads to registry digests	2026-07-30 00:25:16 +02:00
tegwick	52b57c99f7	Add user-engine backup and rollback verification	2026-07-30 00:00:14 +02:00
tegwick	12ac63f32c	Deploy identity drift reconciliation	2026-07-29 23:41:42 +02:00
tegwick	487012e961	Complete identity seams and email login	2026-07-29 23:14:09 +02:00
tegwick	7171587611	Label authenticator entries by user and realm	2026-07-29 22:05:08 +02:00
tegwick	8e7229ae68	Allow user-engine OIDC exchange with KeyCape	2026-07-29 21:40:52 +02:00
tegwick	2fdf21c379	Deploy platform-root claim mapping	2026-07-29 21:31:54 +02:00
tegwick	d2c59fbf5e	Keep provisioner DNS egress in network policy	2026-07-28 17:51:13 +02:00
tegwick	816c5c3773	Deploy reusable password setup handoff	2026-07-28 17:45:09 +02:00
tegwick	76270a239e	Add single-use identity password setup	2026-07-28 17:30:23 +02:00
tegwick	a58df4c3e6	Advance pre-cutover identity conformance	2026-07-28 16:48:47 +02:00
tegwick	43045cbaf5	Verify railiance01 identity dependencies	2026-07-28 12:59:12 +02:00
tegwick	2d13ea84b2	Make Authelia certificate lifecycle explicit	2026-07-28 02:16:07 +02:00
tegwick	8156525a82	Add login alias and record CoulombCore DNS inventory	2026-07-28 01:57:22 +02:00
tegwick	5b8f52749e	Deploy identity administration lifecycle images	2026-07-28 01:30:39 +02:00
tegwick	c9295d278a	Roll forward normalized provisioning images	2026-07-28 01:06:34 +02:00
tegwick	609a718348	Deploy current user-engine provisioning image	2026-07-28 01:00:28 +02:00
tegwick	ba07dd2acb	Add scoped LLDAP identity provisioner	2026-07-28 00:57:16 +02:00
tegwick	9a486c3531	Deploy KeyCape-backed portal login edge	2026-07-28 00:39:22 +02:00
tegwick	49f727c54c	Deploy internal user-engine portal foundation	2026-07-27 23:24:36 +02:00
tegwick	11a14648c4	Register rapp-qonto KeyCape client	2026-07-27 20:17:56 +02:00
tegwick	a9aec541ec	Implement NK-WP-0021 activity-core ops SSO least-privilege. ... Seed LLDAP activity-core-operators, add membership runbook and helper, restrict Authelia access on activity/temporal.coulomb.social to that group (member one_factor + domain deny fallback), apply live, and verify via Authelia check-policy plus unauthenticated edge redirects.	2026-07-22 15:47:26 +02:00
tegwick	3875d546bc	Expose OIDC auth mounts to unauthenticated OpenBao UI listing ... Set listing_visibility=unauth on netkingdom and keycape during OIDC configure so the browser login mask can select KeyCape instead of falling back to token.	2026-06-19 21:04:31 +02:00
tegwick	efbdab4652	feat(keycape): add netkingdom OIDC mount and bao.coulomb.social callbacks ... Configure OpenBao auth for both netkingdom and keycape mounts with browser redirect URIs; update verify scripts and runtime architecture notes.	2026-06-18 01:23:02 +02:00