tegwick
6c4fcaf9ae
- NK-WP-0036 finished: native onboarding journey completed by the operator. - NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human prompt=login flow (auth_time precedes request registration). - identity-provisioner: read-only autocomplete=username field on the setup form (submitted value ignored) and an HTTPS sign-in link on completion. - NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
2.5 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | related | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NK-WP-0041 | workplan | Fix onboarding-journey defects found in the 2026-09-23 human run | infotech | net-kingdom | active | implementation | claude-code | netkingdom | 2026-09-23 | 2026-09-23 |
|
Found by the operator's native onboarding run (NK-WP-0036-T05) and the blocked Vergabe sign-in (NK-WP-0037-T02). Each item names its owner, and only items in this repository are implemented here.
Password managers and sign-in after password setup
id: NK-WP-0041-T01
status: progress
priority: medium
The setup form had no username field, so browsers stored the new password
without a login. After setup there was no way on to the sign-in page. The
source is fixed in identity-provisioner:
- The setup form shows the grant's login name as a read-only
autocomplete="username"field. The submitted value is ignored, and the form no longer setsautocomplete="off". - The completion page links to
PASSWORD_SETUP_SIGNIN_URL(HTTPS only) when there is no company return. The deployment declareshttps://users.coulomb.social/. - The completion page still does not show the login name, as an existing test requires.
Four new HTTP tests cover this, and the 32 provisioner tests pass. Remaining: publish through the identity-provisioner image lane, then promote the digest with operator approval.
Plus-addressed email sign-in fails with an LDAP filter error
id: NK-WP-0041-T02
status: todo
priority: medium
Authelia's users_filter accepts uid or mail. Sign-in as
bernd.worsch+99@gmail.com failed with "LDAP Result Code 201 Filter Compile
Error: invalid characters for escape", not a clean result. A probe with fake
addresses (nk-probe@example.invalid compared with nk-probe+x@…) showed
that only the + form triggers the error. Establish whether Authelia 4.38
escapes + DN-style inside the filter, and fix it through the reference
configuration or the version. Users who use plus-addressing cannot sign in
by email until then.
Route the portal findings to user-engine
id: NK-WP-0041-T03
status: todo
priority: low
These belong to user-engine:
- The setup link is shown to the provider instead of being delivered to the recipient (journey U04/T03: mail delivery unresolved).
- The derived login name (
bernd.worsch-99) is not obvious to the recipient. - There is no sign-in link from the user entry once a password has been set.
Send these to user-engine and record the reply.