coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cancel NK-WP-0001-T04; extract Keycloak federation into NK-WP-0011

Browse Source 
NK-WP-0001-T04 (privacyIDEA, Keycloak path) -> cancelled, superseded by
NK-WP-0003-T04 in the deployed KeyCape stack. T05-T08 (Keycloak SSO,
realm/MFA flow, user mgmt, DR) -> cancelled and migrated to NK-WP-0011.

NK-WP-0011 reframes the deferred Keycloak work as expanded-mode enterprise
federation: Keycloak as an identity broker for Entra ID / AD / SAML that
issues IAM Profile-conformant tokens, refined against the current stack
(OpenBao runtime secrets, CloudNativePG, flex-auth/Topaz PDP, recursive
platform/tenant model) rather than the original greenfield assumptions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-05-20 23:48:51 +02:00
parent 2037df49bc
commit ab79a32eba
2 changed files with 265 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
workplans/NK-WP-0001-sso-mfa-platform.md
View File

@@ -21,11 +21,12 @@ superseded_by: NK-WP-0003
> - T01 (secret bootstrap) → replaced by NK-WP-0004 + NK-WP-0005
> - T02 (K8s foundations) → done, reused by NK-WP-0003
> - T03 (PostgreSQL) → done, reused by NK-WP-0003
> - T04 (privacyIDEA) → superseded by NK-WP-0003-T04
> - T05–T08 (Keycloak) → deferred indefinitely; revisit if/when Keycloak
> is needed for enterprise federation or SAML requirements
> - T04 (privacyIDEA) → cancelled; superseded by NK-WP-0003-T04
> - T05–T08 (Keycloak) → extracted into **NK-WP-0011** (enterprise
> federation / SAML, expanded-mode Keycloak). No longer tracked here.
>
> **Active work: see NK-WP-0003.**
> **Active work: see NK-WP-0003 (deployed stack) and NK-WP-0011
> (enterprise federation).**
## Summary
@@ -213,9 +214,9 @@ restore drill passed.
```task
id: NK-WP-0001-T04
state_hub_task_id: 6ad1296a-a488-4031-b665-f77030e971ed
status: in_progress
status: cancelled
priority: high
note: Manifests committed (pvc, configmap, deployment, middleware, ingress). Scripts: create-secrets.sh, enckey-bootstrap.sh, bootstrap-admin.sh. verify-t04.sh. Domain pink.coulomb.social (CP-NK-002/003). Pending: apply to live cluster, run enckey-bootstrap.sh, bootstrap-admin.sh.
note: Cancelled 2026-05-20. privacyIDEA deployment superseded by NK-WP-0003-T04 (privacyIDEA now runs in the live KeyCape stack on RAILIANCE01). This Keycloak-path variant is no longer pursued.
```
Deploy privacyIDEA via `gpappsoft/privacyidea` Helm chart (Artifact Hub) or
@@ -261,8 +262,9 @@ pi-admin enrolled with MFA, trigger-admin created, rate-limiting active.
```task
id: NK-WP-0001-T05
state_hub_task_id: b9f73aa6-9035-4643-9905-64e73a29b298
status: todo
status: cancelled
priority: high
note: Migrated to NK-WP-0011 (enterprise federation / SAML). Refined there against the deployed KeyCape stack and the OpenBao/flex-auth architecture.
```
Build a **custom Keycloak image** that includes the privacyIDEA Provider JAR:
@@ -294,8 +296,9 @@ custom image with privacyIDEA JAR deployed and verified.
```task
id: NK-WP-0001-T06
state_hub_task_id: 3b6379a4-a27b-4d25-82be-bc600879f036
status: todo
status: cancelled
priority: medium
note: Migrated to NK-WP-0011 (enterprise federation / SAML).
```
In Keycloak:
@@ -327,8 +330,9 @@ modes handled gracefully.
```task
id: NK-WP-0001-T07
state_hub_task_id: c7cf902a-b480-4545-a536-293070945206
status: todo
status: cancelled
priority: medium
note: Migrated to NK-WP-0011 (enterprise federation / SAML).
```
**Decision D2 applies:** identity source of truth is Keycloak-internal with
@@ -369,8 +373,9 @@ audit logs flowing, Keycloak resolver configured.
```task
id: NK-WP-0001-T08
state_hub_task_id: 9cbd1d89-b5bf-491e-9d16-b1c7d57076fb
status: todo
status: cancelled
priority: medium
note: Migrated to NK-WP-0011 (enterprise federation / SAML).
```
**Backups:**