tegwick
48a75b1a54
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
56 lines
2.1 KiB
Markdown
56 lines
2.1 KiB
Markdown
---
|
|
id: NK-WP-0037
|
|
type: workplan
|
|
title: "Bind password setup to the Vergabe company welcome and sign-in"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-09-12"
|
|
updated: "2026-09-12"
|
|
related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
|
|
---
|
|
|
|
## Keep the company return inside the one-use setup grant
|
|
|
|
```task
|
|
id: NK-WP-0037-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies
|
|
it at startup, and stores the destination inside the recipient's grant when
|
|
issuing a setup link. Only successful password setup releases the company link.
|
|
The service-authenticated provisioning tenant selects it; browser return fields
|
|
are ignored. No recipient, credential or setup token travels to the product.
|
|
The product performs its own fresh login and explicit account confirmation.
|
|
|
|
Sixteen provisioner tests pass, including real HTTP issuance/completion,
|
|
malicious return fields, replay/expiry, other tenants and configuration validation.
|
|
Existing setup links remain process-local and expire on restart.
|
|
|
|
## Bind and release the provider and company client
|
|
|
|
```task
|
|
id: NK-WP-0037-T02
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Register public client vergabe-demo-company with only openid/profile/groups,
|
|
authorization_code and the exact callback
|
|
https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/.
|
|
No client-declared tenant, secret, public registration or MFA downgrade.
|
|
Preserve all existing KeyCape configuration using the established guarded
|
|
client-registration lane. KEY-WP-0033 retains fresh-login propagation and the
|
|
shared issuer rollout preflight.
|
|
|
|
Set PASSWORD_SETUP_TENANT_RETURNS to map tenant:trial:demo-company to
|
|
https://vergabe-teilnahme.coulomb.social/demo-company/. Publish and pin the
|
|
provisioner image with its 25m/32Mi request unchanged. Preserve the password
|
|
setter, credential references and directory contents. Recipient sign-in and
|
|
provider-required MFA need an attended acceptance; no credential capture or
|
|
operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and
|
|
RAPPS-WP-0014 retains application placement and recovery.
|