# Native portal login and tenant-onboarding repair — 2026-09-11

Owner: NK-WP-0036. Actual tenant/product admission remains RAPPS-WP-0014.

The approved public `user-engine-portal` client was absent from live KeyCape.
The bounded helper repaired only that missing registration in sso/keycape-config.
Secret UID `2e94519d-1550-41c7-9701-2efe47fe1fd3`, resourceVersion
`58747126` → `59999030`; unrelated configuration bytes and Secret data preserved.
The full bootstrap generator was not run. Its source now retains the existing
client declaration; four synthetic helper/bootstrap tests pass.

KeyCape rollout succeeded with its prior image
`sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`
and 25m CPU request. Read-only verification uses
`sso-mfa/k8s/keycape/verify-user-engine-portal.py`: valid S256 authorize redirects
to Authelia; wrong callback is refused with redirect_uri, missing PKCE with
missing_pkce. The first probe incorrectly expected code_challenge for the latter;
the probe expectation was corrected to the implementation's documented error.

The operator then authenticated natively as platform-root and reached the tenant
creation form (browser observation at 18:35:42 UTC). Their manual submission
returned provisioning_unavailable, correlation
`corr_d41f417c61713afc7ddea08f`. Tenant Engine logged POST /tenants 403 before its
store-create call. That establishes a downstream denial, not an identity-provider
outage. No tenant existence is claimed without native readback.

The deployed portal calls Tenant Engine as user-engine. Its PDP policy had no
such subject and also lacked the tenant.read action now required by the endpoint.
NK-WP-0036-T03 tracks the minimal policy integration, adapter error mapping,
immutable CI image promotion and live positive/negative verification. Human
credentials, session cookies and the chosen administrator's private contact
information are excluded from this record.

Local validation: Flex Auth make test (including race tests), 27 policy tests and
35 fixtures pass; actual registry-enriched create request allows policy v2.
User Engine make test: 169 tests, 3 optional integration skips, layer check passed;
regression proves authority 403 reaches the browser as redacted 403 without
creating an administrator. Source fixes: flex-auth dd8dd51, user-engine 3c85e56.
CI publication/live promotion are pending; these are not live success claims.