From 4175709024d26ed0c68c7e7c7fd476d0d87a31e7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 12 Sep 2026 01:08:33 +0200 Subject: [PATCH] plan: connect identity setup to the tenant welcome page Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- WORK-RECORDS.md | 1 + .../VERGABE-WP-0019-invited-company-pilot.md | 48 ++++++++++++++++++- 2 files changed, 47 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e7902a4..753ce1a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -35,6 +35,7 @@ | task | VERGABE-WP-0019-T03 | progress | — | workplans/VERGABE-WP-0019-invited-company-pilot.md | | task | VERGABE-WP-0019-T04 | wait | — | workplans/VERGABE-WP-0019-invited-company-pilot.md | | task | VERGABE-WP-0019-T05 | done | — | workplans/VERGABE-WP-0019-invited-company-pilot.md | +| task | VERGABE-WP-0019-T06 | todo | — | workplans/VERGABE-WP-0019-invited-company-pilot.md | | task | VT-WP-0001-T03 | done | — | workplans/VT-WP-0001-projektgeruest.md | | task | VT-WP-0001-T05 | done | — | workplans/VT-WP-0001-projektgeruest.md | | task | VT-WP-0001-T07 | done | — | workplans/VT-WP-0001-projektgeruest.md | diff --git a/workplans/VERGABE-WP-0019-invited-company-pilot.md b/workplans/VERGABE-WP-0019-invited-company-pilot.md index f21288c..1e107c7 100644 --- a/workplans/VERGABE-WP-0019-invited-company-pilot.md +++ b/workplans/VERGABE-WP-0019-invited-company-pilot.md @@ -8,7 +8,7 @@ status: active owner: the-custodian topic_slug: vergabe-teilnahme created: "2026-09-11" -updated: "2026-09-11" +updated: "2026-09-12" related: [VERGABE-WP-0018, RAPPS-WP-0014, HFACT-WP-0001, CUST-WP-0071] state_hub_workstream_id: "85b5f304-d497-5570-bebf-3a3669ef6a7d" --- @@ -108,7 +108,7 @@ status: wait priority: high assignee: the-custodian depends_on: [VERGABE-WP-0019-T03] -blocking_reason: "Native demo-company exists and hostname/path is selected. Await identity-provisioner service-login repair, admitted application deployment and demonstrated restore." +blocking_reason: "Native tenant/user/password setup is verified. Await admitted application placement, tenant welcome/sign-in connection and demonstrated restore." state_hub_task_id: "db807f96-f5b8-528d-bc33-75a33fbbf1e4" ``` @@ -155,3 +155,47 @@ login failed in identity-provisioner at LLDAP service authentication (HTTP 401). Its existing credential was reloaded without rotation; the connection still fails. NetKingdom tracks that owner-credential reconciliation before identity provisioning retries. No passwords or private addresses enter this record. + + +2026-09-12 native follow-through: the credential repair is verified, the operator +reports successful user password setup, and live read-only User Engine evidence +shows three memberships with one linked directory identity. This supersedes the +preceding service-login failure. It does not create a Django account or session. + +## Connect identity setup to the company's welcome and sign-in page + +```task +id: VERGABE-WP-0019-T06 +status: todo +priority: high +assignee: the-custodian +state_hub_task_id: "455b33f9-163a-5389-86a3-04000c32d176" +``` + +The operator successfully sets a user's directory password, but the provider ends +on a generic Password set page. The user requests a welcome page for the tenant +on the application. Target the selected +https://vergabe-teilnahme.coulomb.social/demo-company/ entry point. + +Finish RAPPS-WP-0014-T02's real application route/data/placement, then preserve +company and intended recipient through the invitation/password-setup handoff +using exact allowed HTTPS return locations. Show a tenant-specific welcome page +and a clear sign-in action. Connect application authentication to the existing +NetKingdom identity contract, with issuer, signature, audience, expiry and exact +tenant validation, and a stable subject-to-local-account mapping. Keep ordinary +users non-staff and reject wrong-tenant identities. No password copying or +operator-session impersonation is an acceptable bridge. + +The administrator may create another user's setup link while signed in as +platform-root. Completing that link must not turn the operator's existing portal +or shared SSO session into the recipient's application session. Handle the +explicit fresh-user sign-in/account-switch boundary; USER-WP-0025-T03 retains +complete provider sign-out coordination. Preserve the single-company database, +media and issue-state isolation and the accepted 60m allocation. + +Verify a fresh invited user follows setup → company welcome → authenticated +application, sees the correct company, and can enter the pilot workflow. Verify +invalid/expired setup returns, unapproved external return URLs, wrong-tenant +identities and operator-session confusion fail safely. Keep setup tokens, +credentials and personal addresses out of work records. The earlier manual +Django login gate remains an interim product capability, not SSO proof.