121 lines
3.3 KiB
Markdown
121 lines
3.3 KiB
Markdown
# Phase 2: Authentication & Multi-Tenancy - Discussion Log
|
|
|
|
> **Audit trail only.** Do not use as input to planning, research, or execution agents.
|
|
|
|
**Date:** 2026-06-18
|
|
**Phase:** 2-Authentication & Multi-Tenancy
|
|
**Areas discussed:** Login-Flow, Admin-Setup, Mandanten-Modell, LDAP-Import
|
|
|
|
---
|
|
|
|
## Login-Flow
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Zentriert/Minimal | Logo + Formular mittig | |
|
|
| Split-Screen | Links Branding/Bild, rechts Formular | ✓ |
|
|
| Du entscheidest | Claude waehlt | |
|
|
|
|
**User's choice:** Split-Screen
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| 8 Stunden | Arbeitstag | |
|
|
| 24 Stunden | Ein Tag | |
|
|
| 30 Tage + Remember | Langlebig mit Angemeldet-bleiben | ✓ |
|
|
| Du entscheidest | Claude waehlt | |
|
|
|
|
**User's choice:** 30 Tage + Remember
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Ja, per E-Mail | Reset-Link per E-Mail | |
|
|
| Nur Admin-Reset | Admin setzt manuell zurueck | |
|
|
| Beides | Self-Service + Admin-Reset | ✓ |
|
|
|
|
**User's choice:** Beides
|
|
|
|
---
|
|
|
|
## Admin-Setup
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| E-Mail + Passwort | TESSERA_ADMIN_EMAIL + PASSWORD | |
|
|
| Username + Passwort | TESSERA_ADMIN_USER + PASSWORD | |
|
|
| Beides | Username + E-Mail + Passwort | ✓ |
|
|
|
|
**User's choice:** Beides (alle drei ENV-Variablen)
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Ja, Pflicht | Force-Change beim ersten Login | |
|
|
| Nein | ENV-Passwort bleibt | |
|
|
| Optional konfigurierbar | Per ENV einstellbar | ✓ |
|
|
|
|
**User's choice:** Optional konfigurierbar (TESSERA_FORCE_CHANGE)
|
|
|
|
---
|
|
|
|
## Mandanten-Modell
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Subdomain | firma.tessera.de | |
|
|
| Nach Login | Tenant per Benutzer-Zuordnung | |
|
|
| Tenant-Auswahl | Benutzer waehlt Mandant | |
|
|
| Du entscheidest | Claude waehlt | ✓ |
|
|
|
|
**User's choice:** Du entscheidest
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Ja | Multi-Tenant pro User | |
|
|
| Nein | Ein Mandant pro User | |
|
|
| Spaeter | Erstmal einer, spaeter mehrere | ✓ |
|
|
|
|
**User's choice:** Spaeter (erstmal ein Mandant pro User)
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Ja | Super-Admin fuer alle Mandanten | ✓ |
|
|
| Nein | Jeder Admin nur eigener Mandant | |
|
|
| Ja, spaeter | Super-Admin kommt spaeter | |
|
|
|
|
**User's choice:** Ja (Super-Admin von Anfang an)
|
|
|
|
---
|
|
|
|
## LDAP-Import
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Manuell per Button | Admin klickt Sync | |
|
|
| Manuell + Auto-Sync | Button + Intervall | ✓ |
|
|
| Nur Auto-Sync | Nur automatisch | |
|
|
|
|
**User's choice:** Manuell + Auto-Sync
|
|
|
|
| Option | Description | Selected |
|
|
|--------|-------------|----------|
|
|
| Deaktivieren | User wird deaktiviert | ✓ |
|
|
| Loeschen | User wird entfernt | |
|
|
| Nichts | Nur Import, keine Sync | |
|
|
|
|
**User's choice:** Deaktivieren
|
|
|
|
**LDAP Feld-Mapping:** Konfigurierbar mit Standard-Defaults (displayName → Name, mail → E-Mail, sAMAccountName → Username). Custom-Felder muessen auch mappbar sein.
|
|
|
|
---
|
|
|
|
## Claude's Discretion
|
|
|
|
- Tenant-Identifikation (JWT-Claim vs Header vs Middleware)
|
|
- JWT vs Session-Cookie Implementierung
|
|
- SMTP-Konfiguration Struktur
|
|
- Keycloak vs eigene Auth-Loesung
|
|
|
|
## Deferred Ideas
|
|
|
|
None
|