coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record reusable password handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 17:56:04 +02:00
parent 746bf21715
commit 53d38f2f1e
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/USER-WP-0020-self-service-and-user-administration-portal.md
View file

@ -89,6 +89,14 @@ resumable onboarding. Authentication and factor screens must redirect or
handoff to NetKingdom-owned surfaces; the portal must never handle provider handoff to NetKingdom-owned surfaces; the portal must never handle provider
admin credentials or store password/MFA secrets. admin credentials or store password/MFA secrets.
2026-07-28 increment: the deployed portal presents an HTTPS-only interstitial
to NetKingdom's 15-minute, single-use password setup surface after provisioning
and lets an authorized administrator renew that handoff for an already-linked
identity. The portal never receives the password. Adapter and browser
regressions are included in the 105-test passing suite. Invitation,
verification, consent/profile, tenant selection, MFA enrollment, and full
accessibility breadth remain.
## T04 - Implement tenant-admin and platform-admin UX ## T04 - Implement tenant-admin and platform-admin UX
```task ```task
@ -174,8 +182,12 @@ persisted the LLDAP subject link with `password_setup_required`. A live
newline-bearing proxy Secret exposed an HTTP transport bug; commit `0ef2ae5` newline-bearing proxy Secret exposed an HTTP transport bug; commit `0ef2ae5`
normalizes required runtime values, adds regression coverage, passes all 105 normalizes required runtime values, adds regression coverage, passes all 105
tests (three integration skips), and is deployed on railiance01. The remaining tests (three integration skips), and is deployed on railiance01. The remaining
acceptance gate is a reusable first-password handoff and MFA enrollment: reusable first-password gate is now deployed: an authorized portal action
LLDAP SMTP is not configured, and no one-shot operator password was used. creates or renews a 15-minute, single-use NetKingdom URL. Live disposable-user
conformance proved revocation, validation without consumption, OPAQUE password
registration, directory login, replay denial, and cleanup. Remaining Binky
acceptance is the human-selected password, MFA enrollment, and tenant
claim/denial evidence; no one-shot operator password was used.
## T08 - Closure and next-stage handoff ## T08 - Closure and next-stage handoff