Joseph Doherty
3dd7aa40ff
Publishes the three ZB.MOM.WW.LocalDb packages to the Gitea feed (restore-verified from a scratch consumer) and adds the build/push.sh the other shared libs already have. The status prose across CLAUDE.md, README.md and components/*/GAPS.md had drifted from reality, so it was re-derived from the feed listing and the actual PackageReferences + registration calls on each consumer's default branch rather than from prior claims. Five claims were false: Health "not yet adopted" (all four apps wire MapZbHealth), GalaxyRepository's mxaccessgw adoption "a follow-on" (its Server wires AddZbGalaxyRepository), Configuration "not yet pushed", Secrets G-8 "not yet committed", and Theme pinned at 0.2.0 (all four are on 0.3.1). Every doc also said "three apps" while HistorianGateway is a fourth consumer of seven libs, and all eight libraries' test counts were stale (re-ran each suite; all green). Surfaces one previously unrecorded gap: Secrets source is at 0.1.3 with KEK rotation committed, but the feed tops out at 0.1.2, so no app can consume rotation until it is published. Health and observability divergence tables are labelled historical, not re-verified — the libraries are proven wired, but per-app probe coverage vs spec was not re-walked. Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
Auth (login / identity / authorization)
First normalized component. Goal: path to shared code — converge the three sister
projects onto a common identity + API-key contract, proposed as the ZB.MOM.WW.Auth
library set, while each project keeps its own authorization vocabulary.
- The one target:
spec/SPEC.md - The proposed shared library:
shared-contract/ZB.MOM.WW.Auth.md - Divergences + backlog:
GAPS.md - Current state, per project:
current-state/
Why auth is a strong first candidate
All three projects authenticate humans via LDAP (GLAuth in dev), do bind-then-search,
read groups from memberOf, use a service account, support TLS/StartTLS with an
AllowInsecureLdap dev escape hatch, and never log secrets. Two of three implement an
almost identical peppered HMAC-SHA256 API-key scheme with constant-time comparison. That
common core is re-implemented per repo and has already drifted (config key names, dev base DN,
cookie names). Authorization, by contrast, is genuinely domain-specific and is not unified.
Status by project
| Project | AuthN today | Machine auth | AuthZ model (stays per-project) | Sessions | Adoption status |
|---|---|---|---|---|---|
| OtOpcUa | LDAP (GLAuth) via OPC UA UserName token; X.509 + anonymous also | — (OPC UA transport security) | NodePermissions bitmask (data-plane ACL trie) + AdminRole (control-plane) |
Per-session UserAuthorizationState, 5-min freshness / 15-min staleness, generation-bound |
Not started |
| MxAccessGateway | LDAP (GLAuth) for dashboard | API keys (mxgw_…, SQLite, peppered HMAC, scopes + constraints) |
gRPC scopes (session:*/invoke:*/events:*/metadata:*/admin) + dashboard Admin/Viewer |
Dashboard cookie (8h sliding) + 30-min Data-Protection hub bearer | Not started |
| ScadaBridge | LDAP for UI/CLI/Management API (Basic→LDAP) | API keys (X-API-Key, peppered HMAC, per-method approval) — Inbound API only |
Roles Admin/Design/Deployment/Audit/AuditReadOnly + site-scoping |
Cookie (…ScadaBridge.Auth, 30-min idle) + 15-min refresh JWT for programmatic |
Not started |
See each project's current-state/<project>/CURRENT-STATE.md for the
code-verified detail and its adoption plan.
Normalized vs. left per-project
Normalized (the shared target): LDAP/identity config schema + canonical key names;
bind-then-search behavior incl. DN/filter escaping and timeouts; a generic group→role
mapping seam; the standardized canonical role set every project maps onto
(spec/CANONICAL-ROLES.md); the API-key contract (token format,
peppered HMAC-SHA256, constant-time compare, audit); cookie/claim conventions; dev-bypass
flag conventions; secret handling.
Left per-project (native enforcement, mapped onto the canonical roles): the authorization
enforcement vocabularies (NodePermissions / gRPC scopes / app roles + site-scoping), OPC UA
transport security, OtOpcUa's generation/staleness session model, ScadaBridge's site-scope rules.