TSYS Group COO
fcd484ff97
Completed: BW sync fix, Cloudron 2FA, Discourse SSO+API key, Gitea token. Blocked: Redmine SSO needs Cloudron app access granted by admin.
55 lines
2.5 KiB
Markdown
55 lines
2.5 KiB
Markdown
# STATUS.md — Agent Identity Provisioning
|
|
|
|
**Last updated:** 2026-08-13 (Session 2)
|
|
**Phase:** Active development — vp-techops provisioning in progress
|
|
|
|
## Current State (Session 2)
|
|
|
|
### Completed
|
|
|
|
- [x] **BW state sync fixed** — added `sync()` to `login()` lifecycle; 5-phase cross-container persistence test passes
|
|
- [x] **Container UID/GID fixed** — provision user now matches host TSGCOO (1002:1002)
|
|
- [x] **Cloudron 2FA enabled** — TOTP on vp-techops account, secret stored in BW, full round-trip verified
|
|
- [x] **Discourse SSO + signup** — account created (username: vptechops), SSO via OpenID Connect working
|
|
- [x] **Discourse API key** — User API key generated via RSA flow, stored in BW, verified working
|
|
- [x] **Gitea token** — stored in BW, verified working (user=vptechops, active=true)
|
|
- [x] **BW vault** — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)
|
|
|
|
### Blocked (needs Charles)
|
|
|
|
- [ ] **Redmine SSO** — Cloudron returns "You do not have access" when vp-techops tries OIDC to Redmine. Charles must grant Redmine app access for the vp-techops Cloudron user.
|
|
- [ ] **Redmine API key** — blocked by SSO above
|
|
|
|
### Remaining
|
|
|
|
- [ ] Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
|
|
- [ ] Integrate Discourse/Gitea flows into provision-agent.py main script
|
|
- [ ] Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)
|
|
|
|
## BW Vault State
|
|
|
|
| Item | Username | Password | TOTP |
|
|
|---|---|---|---|
|
|
| vp-techops Cloudron | tsgstaff-coo-vptechops@turnsys.com | 32 chars | Enabled |
|
|
| vp-techops Discourse | vptechops | 32-char API key | N/A |
|
|
| vp-techops Gitea | vptechops | 40-char token | N/A |
|
|
|
|
## Key Technical Discoveries (Session 2)
|
|
|
|
1. **Cloudron 2FA flow:** Profile -> Setup -> switchToTotp (Cloudron defaults to Passkey) -> extract base32 secret -> #totpTokenInput -> Enable
|
|
2. **Cloudron OIDC TOTP field:** `#inputTotpToken` (not `#inputTotp` as previously assumed)
|
|
3. **Discourse SSO:** Click `.login-button` -> click `button:has-text("OpenID")` in modal
|
|
4. **Discourse User API Key:** RSA-based flow with PKCS1v15 padding (not OAEP). Response payload is JSON: `{"key":"...","nonce":"..."}`
|
|
5. **Discourse API auth:** Use `User-Api-Key` header (not `Api-Key`)
|
|
|
|
## Provisioner Container
|
|
|
|
- Image: `agent-identity-provisioning-provision:latest`
|
|
- UID/GID: 1002:1002 (matches host TSGCOO)
|
|
- Source code mounted as read-only volumes for fast iteration
|
|
- BW state persists via `./bw-state` bind mount + `sync()` after every login
|
|
|
|
## Ticket
|
|
|
|
[#442](https://projects.knownelement.com/issues/442)
|