Zitadel + LLDAP provisioning scripts and seed users

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

charles/koinos#5

claude-desktop commented

2026-04-14 20:40:44 +00:00

Collaborator

Goal

Zitadel and LLDAP come up pre-configured for local dev: realm/project/application created in Zitadel, LDAP user federation configured, a handful of seed users (admin, two practitioners, a secretariat).

Acceptance criteria

LLDAP

LLDAP seeded with an admin, dr.alice, dr.bob, secretariat.claire.
Groups: koinos-admins, koinos-practitioners, koinos-secretariat.
Seed script idempotent (re-running is a no-op on unchanged state).

Zitadel

Project koinos with an OIDC application for the backend (confidential) and one for the web client (public + PKCE).
LLDAP configured as a federated user source.
Seed users imported.
Claims mapped: sub, email, roles (from groups), preferred_username.
Client credentials written to a dev .env file consumed by backend and web.

Scripts

deploy/identity/bootstrap.sh idempotent, prints clear progress.
Documented in deploy/README.md.

Out of scope

Pro Santé Connect federation (v0.2).
FranceConnect+ (v0.2).
WebAuthn enforcement (tracked later).

References

spec/03-architecture/03-identity-auth.md.
spec/08-roadmap-mvp.md — step #5.

## Goal Zitadel and LLDAP come up pre-configured for local dev: realm/project/application created in Zitadel, LDAP user federation configured, a handful of seed users (admin, two practitioners, a secretariat). ## Acceptance criteria ### LLDAP - [ ] LLDAP seeded with an `admin`, `dr.alice`, `dr.bob`, `secretariat.claire`. - [ ] Groups: `koinos-admins`, `koinos-practitioners`, `koinos-secretariat`. - [ ] Seed script idempotent (re-running is a no-op on unchanged state). ### Zitadel - [ ] Project `koinos` with an OIDC application for the backend (confidential) and one for the web client (public + PKCE). - [ ] LLDAP configured as a federated user source. - [ ] Seed users imported. - [ ] Claims mapped: `sub`, `email`, `roles` (from groups), `preferred_username`. - [ ] Client credentials written to a dev `.env` file consumed by backend and web. ### Scripts - [ ] `deploy/identity/bootstrap.sh` idempotent, prints clear progress. - [ ] Documented in `deploy/README.md`. ## Out of scope - Pro Santé Connect federation (v0.2). - FranceConnect+ (v0.2). - WebAuthn enforcement (tracked later). ## References - `spec/03-architecture/03-identity-auth.md`. - `spec/08-roadmap-mvp.md` — step #5.

claude-desktop added this to the v0.1 milestone

claude-desktop added the

area:identity

type:chore

labels

Rows
Columns

Zitadel + LLDAP provisioning scripts and seed users #5