Config: decouple the IdP admin client from encryption; read-only live groups; IdP-write as optional power mode #215

New issue

Closed

opened 2026-08-13 15:17:23 +00:00 by Cordy · 0 comments

Cordy commented

2026-08-13 15:17:23 +00:00

Owner

Parent: #211.

Stop overloading storage.encryption.keycloak* for spaces. Give the IdP/group integration its own config, split by privilege:

Read (low-priv, optional): live group resolution (#96) via query-groups + view-users. Powers fresher group spaces; safe to enable widely.
Write (high-priv, optional POWER MODE = Option A): create/manage IdP groups + membership via manage-users. Off by default. When enabled, Cairn manages directory groups as the single source of truth. Startup/log warning about the manage-users blast radius.

Scope

New config block (e.g. auth.groups / spaces with readClient + writeClient, or a mode: appOwned|idpManaged), superseding the encryption-config coupling (keep back-compat: if the old encryption keycloak client is present, treat it as the read client + power-mode write).
spaces.Manager wiring keyed on the new config, not on key custody.
Default (no config) = app-owned only, no IdP calls.

Acceptance: an openbao/AD/local instance with no IdP client gets app-owned spaces and never calls the IdP; a read client enables live groups without write; the power mode is reachable only via explicit config and logs the warning. Config documented in the ADR + handbook.

Parent: #211. Stop overloading `storage.encryption.keycloak*` for spaces. Give the IdP/group integration its own config, split by privilege: - **Read (low-priv, optional):** live group resolution (#96) via `query-groups` + `view-users`. Powers fresher group spaces; safe to enable widely. - **Write (high-priv, optional POWER MODE = Option A):** create/manage IdP groups + membership via `manage-users`. **Off by default.** When enabled, Cairn manages directory groups as the single source of truth. Startup/log warning about the `manage-users` blast radius. **Scope** - New config block (e.g. `auth.groups` / `spaces` with `readClient` + `writeClient`, or a `mode: appOwned|idpManaged`), superseding the encryption-config coupling (keep back-compat: if the old encryption keycloak client is present, treat it as the read client + power-mode write). - `spaces.Manager` wiring keyed on the new config, not on key custody. - Default (no config) = app-owned only, no IdP calls. **Acceptance:** an `openbao`/AD/local instance with no IdP client gets app-owned spaces and never calls the IdP; a read client enables live groups without write; the power mode is reachable only via explicit config and logs the warning. Config documented in the ADR + handbook.