dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases Wiki Activity

Re-query LDAP group membership for active sessions #46

New Issue
Open
opened 2026-11-06 15:24:35 -05:00 by dohertj2 · 0 comments
dohertj2 commented 2026-11-06 15:24:35 -05:00
Owner
Copy Link
Copy Source

Register row 23 (deferred-work register).

The mid-session role refresh re-maps the stored groups against the central DB without an LDAP call, so a directory group change lands only at next login. A live re-query needs a passwordless group-search API on the shared ZB.MOM.WW.Auth.Ldap library (currently only AuthenticateAsync(username, password, ct)). Central role-mapping/scope changes still apply within ~15 min (RoleRefreshThresholdMinutes).

Revisit trigger (from register): ZB.MOM.WW.Auth.Ldap gains a standalone group-search API, or a requirement that directory-side revocation take effect mid-session.

Current state: Blocked on the external ZB.MOM.WW.Auth package (lives in scadaproj). Auth 0.4.x added user-bind mode but no standalone group search — verify still open.
Related: docs/requirements/Component-Security.md :61-69, :78-79.

Source: docs/plans/2026-07-08-deferred-work-register.md row 23

Register row 23 (deferred-work register). The mid-session role refresh re-maps the *stored* groups against the central DB without an LDAP call, so a directory group change lands only at next login. A live re-query needs a passwordless group-search API on the shared `ZB.MOM.WW.Auth.Ldap` library (currently only `AuthenticateAsync(username, password, ct)`). Central role-mapping/scope changes still apply within ~15 min (`RoleRefreshThresholdMinutes`). **Revisit trigger (from register):** `ZB.MOM.WW.Auth.Ldap` gains a standalone group-search API, or a requirement that directory-side revocation take effect mid-session. **Current state:** Blocked on the external `ZB.MOM.WW.Auth` package (lives in scadaproj). Auth 0.4.x added user-bind mode but no standalone group search — verify still open. Related: `docs/requirements/Component-Security.md` :61-69, :78-79. Source: `docs/plans/2026-07-08-deferred-work-register.md` row 23
dohertj2 added the type:featurepriority:p3blockedcross-repomigrated labels 2026-11-06 15:24:35 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocked
Blocked by dependency or external hold
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label blocked cross-repo migrated priority:p3 type:feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/ScadaBridge#46
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?