dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(plan): flag ignitionoee LDAP as ON HOLD -- needs new UG_WW_* groups minted first

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-13 15:01:15 -04:00
parent 206c588608
commit 205bddb3b8
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-08-13-vd03-nam-ldap-cutover.md
+8
View File
@@ -24,6 +24,12 @@ Out of scope: windev's OtOpcUa/mxgw instances, the QA pair (VQ03/VQ04 — do it
follow-on once VD03 has soaked; QA is where the 2-node/failover behaviour actually gets follow-on once VD03 has soaked; QA is where the 2-node/failover behaviour actually gets
exercised), and OtOpcUa's OPC UA data plane (API-key auth since Gitea #520). exercised), and OtOpcUa's OPC UA data plane (API-key auth since Gitea #520).
> ⚠️ **ignitionoee (router): LDAP setup ON HOLD** — explicit decision 2026-08-13. Its role
> vocabulary is not the canonical set (its admin role is literally `"Admin"`, not
> `"Administrator"`), so no existing `UG_WW_*` group maps onto it — a NAM cutover there
> would first require **minting new AD groups**. Do not wire its LDAP as part of this plan
> or its follow-ons; it keeps its current auth until the groups exist and are decided.
## The target LDAP block (identical shape in all four apps) ## The target LDAP block (identical shape in all four apps)
```jsonc ```jsonc
@@ -251,3 +257,5 @@ Phase 1's redeploys are independent and should NOT be rolled back for an auth pr
glauth-redundant pair (uncommitted working-tree change, independent of this plan). glauth-redundant pair (uncommitted working-tree change, independent of this plan).
- ldap_mapping.md is still untracked in scadaproj — commit it when its DECIDE items - ldap_mapping.md is still untracked in scadaproj — commit it when its DECIDE items
settle; this plan depends on its §4 tables. settle; this plan depends on its §4 tables.
- ignitionoee LDAP: **held** (see the Scope flag) until new `UG_WW_*` groups matching its
role vocabulary are minted and mapped — a group-creation request, not a config task.