tegwick
6cd89f0a7a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
2.4 KiB
Native portal login and tenant-onboarding repair — 2026-09-11
Owner: NK-WP-0036. Actual tenant/product admission remains RAPPS-WP-0014.
The approved public user-engine-portal client was absent from live KeyCape.
The bounded helper repaired only that missing registration in sso/keycape-config.
Secret UID 2e94519d-1550-41c7-9701-2efe47fe1fd3, resourceVersion
58747126 → 59999030; unrelated configuration bytes and Secret data preserved.
The full bootstrap generator was not run. Its source now retains the existing
client declaration; four synthetic helper/bootstrap tests pass.
KeyCape rollout succeeded with its prior image
sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611
and 25m CPU request. Read-only verification uses
sso-mfa/k8s/keycape/verify-user-engine-portal.py: valid S256 authorize redirects
to Authelia; wrong callback is refused with redirect_uri, missing PKCE with
missing_pkce. The first probe incorrectly expected code_challenge for the latter;
the probe expectation was corrected to the implementation's documented error.
The operator then authenticated natively as platform-root and reached the tenant
creation form (browser observation at 18:35:42 UTC). Their manual submission
returned provisioning_unavailable, correlation
corr_d41f417c61713afc7ddea08f. Tenant Engine logged POST /tenants 403 before its
store-create call. That establishes a downstream denial, not an identity-provider
outage. No tenant existence is claimed without native readback.
The deployed portal calls Tenant Engine as user-engine. Its PDP policy had no such subject and also lacked the tenant.read action now required by the endpoint. NK-WP-0036-T03 tracks the minimal policy integration, adapter error mapping, immutable CI image promotion and live positive/negative verification. Human credentials, session cookies and the chosen administrator's private contact information are excluded from this record.
Local validation: Flex Auth make test (including race tests), 27 policy tests and 35 fixtures pass; actual registry-enriched create request allows policy v2. User Engine make test: 169 tests, 3 optional integration skips, layer check passed; regression proves authority 403 reaches the browser as redacted 403 without creating an administrator. Source fixes: flex-auth dd8dd51, user-engine 3c85e56. CI publication/live promotion are pending; these are not live success claims.