lex-identity-kerberos 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 179745c0e90a6bb28e83916775c8921f8ce2adbe2ee09558a8231c5079f6a777
-  data.tar.gz: 4647f3681eed0880eb9b479e2dd4f256035593fc5a6c5e697a854d2741ecd138
+  metadata.gz: b18ad754d85e2b8d437b3a136ea8330197fdba43e307a7c0e79fe745e00cf45a
+  data.tar.gz: cc52cbfab524762848fbdfef03064a47846b9338c924881333691f7e1cc945c4
 SHA512:
-  metadata.gz: d40ae32383bee896c1768a46c2c1c3c595af640c983968ecd0aee6c68822a615adc834644ad6354c66a8051f019ea19b6e2cdf9ecb4166a6d4250f87f8ed59cf
-  data.tar.gz: 5a11e86ebdcc9355bdb55b52c5f646b9b2b5d77f3d3c5d9f9da1122107f29e4bc9c00baef7c05511b312829187049acbd5c741b053567abd351fe8c97cefc989
+  metadata.gz: cc0b5f21f144db0c8051eef64d7604d924e5a847f7bffecc2a66171aded5b25cd4e2b35aac0126d0adf0beebbace2803c2bae584e1ed6df65cae895e484b51a6
+  data.tar.gz: 2551f1754c74e95881f698769128665d4a0b2cdc8954d695653db99e7138ac991e3107d0fe6e370e362c6cdba9f94f73495889e0dd95e071bd3ab2e7fe039bd0

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-05-14
+
+### Fixed
+- `crypt_required?` changed from `true` to `false` to prevent boot ordering deadlock where kerberos extension was skipped before `Legion::Crypt` finished initializing.
+
 ## [0.2.0] - 2026-04-24
 
 ### Added

data/CLAUDE.md

@@ -1,95 +1,19 @@
-# lex-identity-kerberos: Kerberos Identity Provider for LegionIO
+# lex-identity-kerberos
 
-**Repository Level 3 Documentation**
-- **Parent (Level 2)**: `/Users/miverso2/rubymine/legion/extensions/CLAUDE.md`
-- **Parent (Level 1)**: `/Users/miverso2/rubymine/legion/CLAUDE.md`
-
-## Purpose
-
-LegionIO identity provider extension that resolves the authenticated Kerberos principal from
-`legion-crypt` into the unified identity provider contract. Does **not** duplicate GSSAPI or LDAP
-logic — those live in `lex-kerberos`. This gem reads the already-resolved principal and provides
-the contract interface for the identity pipeline.
-
-**GitHub**: https://github.com/LegionIO/lex-identity-kerberos
-**License**: MIT
-**Version**: 0.1.1
-
-## Architecture
-
-```
-Legion::Extensions::Identity::Kerberos
-├── Identity                   # Provider contract implementation (resolve, provide_token, normalize, vault_auth)
-└── Helpers/
-    └── Resolver               # Principal extraction from Legion::Crypt.kerberos_principal
-```
-
-## File Map
-
-| File | Purpose |
-|------|---------|
-| `lib/legion/extensions/identity/kerberos.rb` | Entry point; extends Core, declares identity_provider?/remote_invocable?/crypt_required? |
-| `lib/legion/extensions/identity/kerberos/identity.rb` | Provider contract — resolve, provide_token, normalize, vault_auth, capabilities |
-| `lib/legion/extensions/identity/kerberos/helpers/resolver.rb` | principal, extract_username, extract_realm, resolve_identity |
-| `lib/legion/extensions/identity/kerberos/version.rb` | VERSION = '0.1.1' |
+LegionIO identity provider that resolves the authenticated Kerberos principal from `legion-crypt` into the unified identity provider contract. Does **not** duplicate GSSAPI or LDAP logic — those live in `lex-kerberos`. This gem reads the already-resolved principal and provides the contract interface.
 
 ## Key Design Decisions
 
-- Reads `Legion::Crypt.kerberos_principal` (set by `KerberosAuth` at boot in legion-crypt).
-  No `gssapi` gem, no LDAP. Those stay in `lex-kerberos`.
-- `provide_token` returns `Legion::Identity::Lease` (or plain Hash fallback if Lease not defined).
-  Delegates to `lex-kerberos` `Helpers::Spnego.obtain_spnego_token` — guarded with `defined?` + `respond_to?`.
+- Reads `Legion::Crypt.kerberos_principal` (set by `KerberosAuth` at boot). No `gssapi` gem, no LDAP.
+- `provide_token` delegates to `lex-kerberos` `Helpers::Spnego.obtain_spnego_token` — guarded with `defined?` + `respond_to?`.
 - `canonical_name` regex: `^[a-z0-9][a-z0-9_-]*$` — no dots (AMQP word separator).
-- All framework constants guarded with `defined?` checks (never hard-require optional gems).
 - `vault_auth` returns nil — Phase 5 stub.
+- Group lookup is `lex-identity-ldap`'s responsibility, not this gem's.
 
-## Provider Contract Return Values
+## Provider Contract
 
-### `resolve` identity hash
 ```ruby
-{
-  canonical_name: 'miverso2',
-  kind:           :human,
-  source:         :kerberos,
-  principal:      'miverso2@MS.DS.UHC.COM',
-  realm:          'MS.DS.UHC.COM',
-  groups:         []
-}
+{ canonical_name: 'user', kind: :human, source: :kerberos, principal: 'user@REALM', realm: 'REALM', groups: [] }
 ```
 
-Group lookup is `lex-identity-ldap`'s responsibility, not this gem's.
-
-### `provide_token` — `Legion::Identity::Lease`
-```ruby
-lease = Identity.provide_token
-lease.provider    # => :kerberos
-lease.credential  # => '<base64-spnego-token>'
-lease.expires_at  # => Time (10h from now)
-lease.renewable   # => true
-lease.valid?      # => true
-lease.metadata    # => { realm: 'MS.DS.UHC.COM' }
-```
-
-## Dependencies
-
-Hard (in gemspec):
-- `legion-json` (>= 1.2.1)
-- `legion-settings` (>= 1.3.14)
-
-Optional (guarded, not in gemspec):
-- `legion-crypt` — `Legion::Crypt.kerberos_principal`
-- `lex-kerberos` — `Legion::Extensions::Kerberos::Helpers::Spnego#obtain_spnego_token`
-
-## Testing
-
-54 specs across 2 spec files.
-
-```bash
-bundle install
-bundle exec rspec
-bundle exec rubocop
-```
-
----
-
-**Maintained By**: Matthew Iverson (@Esity)
+`provide_token` returns `Legion::Identity::Lease` (or plain Hash fallback if Lease not defined).

data/README.md

@@ -28,11 +28,11 @@ Returns an identity hash or `nil`:
 
 ```ruby
 {
-  canonical_name: 'miverso2',          # ^[a-z0-9][a-z0-9_-]*$ — no dots (AMQP word separator)
+  canonical_name: 'jdoe',          # ^[a-z0-9][a-z0-9_-]*$ — no dots (AMQP word separator)
   kind:           :human,
   source:         :kerberos,
-  principal:      'miverso2@MS.DS.UHC.COM',
-  realm:          'MS.DS.UHC.COM',
+  principal:      'jdoe@CORP.EXAMPLE.COM',
+  realm:          'CORP.EXAMPLE.COM',
   groups:         []                   # group lookup is lex-identity-ldap's responsibility
 }
 ```
@@ -45,7 +45,7 @@ Strips `@REALM`, downcases, trims whitespace, and removes characters outside `[a
 
 ```ruby
 Identity.normalize('User.Name@REALM.COM')  # => 'username'
-Identity.normalize('miverso2@MS.DS.UHC.COM')  # => 'miverso2'
+Identity.normalize('jdoe@CORP.EXAMPLE.COM')  # => 'jdoe'
 ```
 
 ### `provide_token`
@@ -59,7 +59,7 @@ lease.credential  # => '<base64-spnego-token>'
 lease.expires_at  # => Time (10h from now)
 lease.renewable   # => true
 lease.valid?      # => true
-lease.metadata    # => { realm: 'MS.DS.UHC.COM' }
+lease.metadata    # => { realm: 'CORP.EXAMPLE.COM' }
 ```
 
 Requires `lex-kerberos` to be loaded and `Legion::Settings[:kerberos][:service_principal]` to be set.

data/lex-identity-kerberos.gemspec

@@ -28,10 +28,11 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # Core framework dependencies
+  spec.add_dependency 'legion-crypt',    '>= 1.5.13'
   spec.add_dependency 'legion-json',     '>= 1.2.1'
+  spec.add_dependency 'legion-logging',  '>= 1.5.3'
   spec.add_dependency 'legion-settings', '>= 1.3.14'
 
   # Optional runtime dependencies are guarded with defined?() in the source:
-  #   legion-crypt  — for Legion::Crypt.kerberos_principal
   #   lex-kerberos  — for Legion::Extensions::Kerberos::Helpers::Spnego#obtain_spnego_token
 end

data/lib/legion/extensions/identity/kerberos/helpers/resolver.rb

@@ -8,7 +8,7 @@ module Legion
           module Resolver
             module_function
 
-            # Returns the raw Kerberos principal string (e.g. "miverso2@MS.DS.UHC.COM")
+            # Returns the raw Kerberos principal string (e.g. "jdoe@CORP.EXAMPLE.COM")
             # from Legion::Crypt if available, or nil.
             def principal
               return nil unless defined?(Legion::Crypt)

data/lib/legion/extensions/identity/kerberos/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Kerberos
-        VERSION = '0.2.0'
+        VERSION = '0.2.1'
       end
     end
   end

data/lib/legion/extensions/identity/kerberos.rb

@@ -12,7 +12,7 @@ module Legion
 
         def self.identity_provider? = true
         def self.remote_invocable?  = false
-        def self.crypt_required?    = true
+        def self.crypt_required?    = false
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-kerberos
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Esity
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: legion-crypt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.13
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.13
 - !ruby/object:Gem::Dependency
   name: legion-json
   requirement: !ruby/object:Gem::Requirement
@@ -23,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
+- !ruby/object:Gem::Dependency
+  name: legion-logging
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.3
 - !ruby/object:Gem::Dependency
   name: legion-settings
   requirement: !ruby/object:Gem::Requirement