Repository navigation
Integrate durable pairwise identities and audited legacy reconciliation - #1493
Merged
Merged
Conversation
Derive scoped user actors under client policy while retaining local session and family attribution. Fail closed on missing actor-session data and blocked local impersonators. Check device-grant eligibility before identity binding. Qualify pairwise logout targeting, backchannel isolation, profile scope release and the independent session-template boundary. Refs #19, #1385.
Refs #19. Validate sector metadata through hardened HTTPS, fence concurrent replacements, and bound update fetches across token rotation. Preserve bound identities through policy changes; management and historical rollout remain pending.
Refs #19. Read policy and redirects coherently, validate closed offline policy shapes, and preserve legacy public snapshots. Keep salts, bindings and revisions out of exports; prove promotion cannot reset target identity.
Refs #19. Add revision-checked policy reads and writes with management permissions, sudo freshness, hardened sector validation and a narrow control-role grant. Preserve redirects and issued identities. Historical identity migration and rollout qualification remain pending.
Refs #19, encryptixio/civio#1385. Add the scoped client grant index without pruning revoked history or changing privileges. Replace per-user page inserts with one immutable batch. Qualify 10,000 identities against 1.1 million retained grants and document maintenance and measurement limits.
Refs #19, encryptixio/civio#1385. Record real HTTPS account continuity, new pairwise identity, token/UserInfo/introspection parity and pod replacement evidence. Distinguish copied fixtures from production migration and preserve remaining milestone scope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Registered OIDC clients previously used public account identifiers even when pairwise identity was requested. This integrates durable per-client policy and immutable user bindings across token issuance, UserInfo, introspection, token exchange and human impersonation, while keeping authorization tied to local accounts. Existing public identities survive policy changes; new users follow the validated client policy.
Dynamic registration and six documented management operations validate sectors, enforce scoped permissions and revision checks, and provide audited history recovery and explicit reconciliation before legacy activation. Snapshots exclude identity secrets and bindings. Encrypted database backups now retain runtime ACLs so restricted roles can use restored databases.
Validation: targeted PostgreSQL/protocol/management/snapshot/migration suites, clean targeted clippy and repository invariants, encrypted CLI restore with key rotation and restricted roles, and 1.1M-grant history qualification. A real Chrome/Civio deployment verified existing account continuity, fresh pairwise registration, signed ID-token/UserInfo/introspection parity and provider restart. See docs/design/PAIRWISE-INTEGRATION.md for results and limits. Final review found no remaining code blocker; final follow-up changes only clarify documentation. Hosted CI is not a merge gate for this delivery.
Rollout: back up database and roles, stop the old issuer, apply migrations 0251-0255, then start the qualified binary. The grant index builds transactionally. Existing clients stay public and pending reconciliation; activation requires separate history evidence. Public legacy bindings are a documented privacy exception. This does not complete every issuer/JWKS or Civio milestone criterion.
Refs #19 and #1385. Hosted-profile adoption dependency: encryptixio/civio#455.