142 lines
4.6 KiB
Markdown
142 lines
4.6 KiB
Markdown
---
|
|
id: NK-WP-0023
|
|
type: workplan
|
|
title: "Integrate and deploy the user-engine onboarding portal"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-07-27"
|
|
updated: "2026-07-27"
|
|
depends_on:
|
|
- USER-WP-0020
|
|
- KEY-WP-0004
|
|
state_hub_workstream_id: "c652e4ba-6520-4b30-966f-4fb5659439db"
|
|
---
|
|
|
|
# NK-WP-0023 - user-engine portal platform integration
|
|
|
|
Provide the NetKingdom-owned adapters and production integration required by
|
|
`USER-WP-0020`, using the Binky tenant-admin onboarding from `KEY-WP-0004-T02`
|
|
as the first acceptance case.
|
|
|
|
## T01 - Define source-of-truth and provisioning contracts
|
|
|
|
```task
|
|
id: NK-WP-0023-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "8d96aa5e-9801-4d76-9140-d6076a4f2942"
|
|
```
|
|
|
|
Ratify lifecycle sequencing and compensation across user-engine, LLDAP,
|
|
KeyCape, privacyIDEA, flex-auth, email verification, audit, and outbox
|
|
delivery. user-engine owns user-domain and membership intent; NetKingdom IAM
|
|
owns credentials, authentication factors, coarse authentication claims, and
|
|
provider subjects. Define externally-provisioned/federated ownership metadata
|
|
now so later enterprise directories do not require a domain rewrite.
|
|
|
|
## T02 - Implement the NetKingdom identity provisioning adapter
|
|
|
|
```task
|
|
id: NK-WP-0023-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350"
|
|
```
|
|
|
|
Implement idempotent create/link/suspend/reactivate/deprovision operations for
|
|
the lightweight LLDAP + privacyIDEA stack behind user-engine's
|
|
`IdentityProvisioningPort`. Use scoped service identity and approved secret
|
|
transport. Never expose directory admin credentials to the browser or
|
|
user-engine domain. Add reconciliation, retry, compensation, and drift
|
|
reporting rather than assuming a distributed transaction.
|
|
|
|
## T03 - Integrate KeyCape login, claims, and MFA handoffs
|
|
|
|
```task
|
|
id: NK-WP-0023-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "76289890-6e6e-45ea-90dc-d3d58eee8b62"
|
|
```
|
|
|
|
Register the portal OIDC client with authorization code + PKCE, configure
|
|
callback/logout routes, verify issuer/audience/tenant/assurance claims, and
|
|
provide safe password and MFA enrollment/recovery handoffs. Preserve
|
|
platform-root separation and ensure tenant administration never implies
|
|
platform authority.
|
|
|
|
## T04 - Integrate authorization, email, audit, and events
|
|
|
|
```task
|
|
id: NK-WP-0023-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "6ce33c92-031a-4f23-8ee2-108451b394fe"
|
|
```
|
|
|
|
Define and implement flex-auth resources/actions for self, tenant-admin, and
|
|
platform-admin operations; route verification/invitation email without making
|
|
mailbox ownership an authorization fact; correlate user-engine, IAM,
|
|
authorization, and platform audit records; and connect durable outbox
|
|
delivery with replay and dead-letter evidence.
|
|
|
|
## T05 - Deploy on reef-railiance
|
|
|
|
```task
|
|
id: NK-WP-0023-T05
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "4ef00e05-1259-4c76-a8ef-ec40b5facd1c"
|
|
```
|
|
|
|
Package the portal as a managed platform workload on the default
|
|
`rail-kubernetes` path on `reef-railiance`, with Postgres, OpenBao-backed
|
|
runtime references, NetworkPolicies, TLS ingress, backups, observability,
|
|
resource limits, rollout/rollback, and availability evidence. Do not place
|
|
this stateful platform control surface on scale-to-zero Knative.
|
|
|
|
## T06 - Prove role-scoped administration and failure safety
|
|
|
|
```task
|
|
id: NK-WP-0023-T06
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "96a7cd2b-6cab-47ab-a899-44bc0f6da58c"
|
|
```
|
|
|
|
Run end-to-end conformance for registration, login, MFA, tenant creation,
|
|
first-admin bootstrap, invitations, suspension/reactivation, cross-tenant
|
|
denial, platform-admin-only actions, provider outages, replay/idempotency,
|
|
backup restore, and reconciliation after partial failure.
|
|
|
|
## T07 - Complete KEY-WP-0004 through the reusable portal
|
|
|
|
```task
|
|
id: NK-WP-0023-T07
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "a574dcec-f7cd-417b-aeaa-5392a7428241"
|
|
```
|
|
|
|
Use the production portal to onboard
|
|
`bernd.worsch@binky-hedgehog.com` into `tenant:friendly:binky`, complete
|
|
OIDC/PKCE + MFA, and verify the Binky-only tenant-admin token and lifecycle
|
|
controls. Publish only non-secret evidence to `KEY-WP-0004-T02/T07`, then
|
|
finish that workplan.
|
|
|
|
## T08 - Document enterprise integration extension points
|
|
|
|
```task
|
|
id: NK-WP-0023-T08
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "7ef8e1f5-1a0e-4a34-9535-708e3146ae72"
|
|
```
|
|
|
|
Document later adapters for customer IdPs/directories, SAML/OIDC federation,
|
|
SCIM, JIT provisioning, directory group mapping, customer-owned offboarding,
|
|
and conflict/freshness rules. Keep `NK-WP-0011` demand-triggered; this task
|
|
defines compatibility seams, not enterprise implementation.
|