From 818775b3115e341b1859dd9f5ed3e4c192bdc41f Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Wed, 12 Aug 2026 21:27:23 -0400 Subject: [PATCH] docs(index): Auth 0.2.1 published -- AD referral fix + NAM group findings CLAUDE.md: feed now carries 0.2.1; record the referral defect and that every app is still exposed until it bumps off 0.1.5 (a functional fix, not housekeeping), plus the new tools/LdapProbe. ldap_setup.md: findings from probing the live NAM directory -- - LDAPS 636, StartTLS 389 and plain 389 all connect on both DCs. The only TLS chain error is UntrustedRoot, so installing zimmer-rootca is sufficient; the RSA 1024-bit key is rejected only by OpenSSL at SECLEVEL=2, i.e. Debian .NET containers, not by macOS or Windows hosts. - The UG_WW_* Wonderware group convention, 39 groups enumerated directory-wide. This partly overturns this doc's earlier "no group->role convention exists" claim: that was true of Ignition, which was the only source audited, and false of the domain. Three shapes with a consistent role suffix (ADMIN, RO, OPERATOR, ENGINEER, SUPERVISOR, TESTER) across environment and site axes. - A proposed mapping onto CANONICAL-ROLES, with the three gaps left open rather than guessed: SUPERVISOR/TESTER have no canonical equivalent, nothing maps to Deployer, and the DEV/QA/PROD axis is orthogonal to role so it must ride in the per-project scope payload or the role set triples. - The referral defect and its fix. --- CLAUDE.md | 5 +- ldap_setup.md | 202 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 206 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 71453e2..c7b59a8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -141,7 +141,7 @@ each project's **code-verified current state**, and the **gaps** between. See | Component | Status | Goal | Design | Implementation | |---|---|---|---|---| -| Auth (login / identity / authz) | Adopted (**feed now carries `0.2.0`**; all four apps still pin `0.1.5` = `0.1.4` + the SQLitePCLRaw transitive security pin; merged to **local default** main/master + **pushed to origin** (gitea)). **`0.2.0` (2026-08-10) adds LDAP backup-DC sticky failover** — see the Auth narrative below; app pin-bump is a follow-up. | Shared `ZB.MOM.WW.Auth` lib | [`components/auth/`](components/auth/) | [`ZB.MOM.WW.Auth/`](ZB.MOM.WW.Auth/) | +| Auth (login / identity / authz) | Adopted (**feed now carries `0.2.1`**; all four apps still pin `0.1.5` = `0.1.4` + the SQLitePCLRaw transitive security pin; merged to **local default** main/master + **pushed to origin** (gitea)). **`0.2.0` (2026-08-10) adds LDAP backup-DC sticky failover**, **`0.2.1` (2026-08-12) fixes a defect that broke AD logins outright** — an AD continuation referral escaped `NovellLdapConnection.Search`, so any `SearchBase` at a domain root failed every login as `ServiceAccountBindFailed` against a perfectly healthy directory. Live-proven against `DC=nam,DC=zimmer,DC=com`. **Every app is still exposed until it bumps** — see the Auth narrative below; app pin-bump is a follow-up. | Shared `ZB.MOM.WW.Auth` lib | [`components/auth/`](components/auth/) | [`ZB.MOM.WW.Auth/`](ZB.MOM.WW.Auth/) | | UI Theme (layout / tokens / components) | Adopted (feed `0.2.0`–`0.4.1`). **`0.4.0` (2026-08-11) upstreamed the Bootstrap `.btn`/`.btn-sm` sizing block** that all **five** consumers had independently written into their own stylesheets (Bootstrap hard-codes `--bs-btn-font-size: 1rem`, oversized against the kit's 0.9rem body) — sized by `--bs-btn-*` variable override **only**, never by redeclaring box properties, because `.btn-group`'s seam/radius machinery reads those same variables and a literal `font-size` at equal specificity silently flattens `.btn-sm` into a padding-only difference (a real defect found in mxgw's local copy). Same release added the `rail-btn-block` full-width rail-foot modifier; **`0.4.1` fixes it** — 0.4.0 shipped `width: auto`, which fills for an `` but shrink-wraps a `