ee/wcp: separate service account to run browser - #1380

Open

BeryJu wants to merge 44 commits into

mainfrom

ee/wcp/browser-privilege

Commits on Aug 16, 2026

ee/wcp: restore and update the browser-privilege design doc
BeryJu
committed
2f93b8b
ee/wcp: mint the sign-in browser's token from a dedicated account
BeryJu
committed
7b56f4b
ee/wcp: update BROWSER_PRIVILEGE.md for the account work just built
BeryJu
committed
62cfc4c
vpkg/windows: create the dedicated wcp browser service account
BeryJu
committed
4a61cc7
ee/wcp: fix a stale comment about which token the logon path uses
BeryJu
committed
0d1bd36
ee/wcp: record the VM run of the secure-desktop checklist

BeryJu
and
claude
committed
ba9384d
ee/wcp: drop stored-pw's password-reuse machinery from this branch
BeryJu
committed
b609551
Merge remote-tracking branch 'origin/main' into ee/wcp/browser-privilege
BeryJu
committed
499ccb7
ee/wcp: fix a trait name gone stale after merging main
BeryJu
committed
f3aedcc
vpkg/windows: drop $ from the wcp service account's placeholder password
BeryJu
committed
9fd90e7
ee/wcp: trim doc comments down to one point each
BeryJu
committed
6138e7a
vpkg/windows: trim the service account comment to one paragraph
BeryJu
committed
31d6368
vpkg/windows: replace the placeholder password with a random string
BeryJu
committed
a27f2f6

Commits on Aug 17, 2026

Merge branch 'main' into ee/wcp/browser-privilege
BeryJu
committed
d7d1cee
ee/wcp: fix two issues that survived the main merge
BeryJu
committed
b47abe0
Merge branch 'main' into ee/wcp/browser-privilege
BeryJu
committed
fce12c7
Merge branch 'main' into ee/wcp/browser-privilege
BeryJu
committed
c612d9f
try to fix
BeryJu
committed
bc5d521
ee/wcp: enable the privileges CreateProcessAsUserW and the S4U logon need
BeryJu
committed
49de0bc

Commits on Aug 18, 2026

ee/wcp: log which privilege failed and who we're actually running as
BeryJu
committed
1724d85
ee/wcp: replace S4U with LogonUserW + CreateRestrictedToken
BeryJu
committed
458134d
ee/wcp: fix a comment left over from the S4U-to-LogonUserW switch
BeryJu
committed
c23059c
ee/wcp: switch to CreateProcessWithTokenW, named pipes for IPC

BeryJu
and
claude
committed
274d58b
ee/wcp: fix named-pipe DACL for CPUS_CREDUI, detect an early child exit

BeryJu
and
claude
committed
31b8923

Commits on Aug 19, 2026

try without root cache path
BeryJu
committed
cd25b9e
ee/wcp: give each ak_cef.exe launch its own cache directory

BeryJu
and
claude
committed
d9a8658
ee/wcp: build a real environment block for the service account's token

BeryJu
and
claude
committed
0d0aba3
ee/wcp: use CEF's Alloy runtime instead of Chrome style for the sign-in window

BeryJu
and
claude
committed
0172025
ee/wcp: log ak_cef.exe's build hash on startup

BeryJu
and
claude
committed
1b8c2f8
ee/wcp: cleanup pass - drop stale S4U references, trim long comments

BeryJu
and
claude
committed
74fb7f5
ee/wcp: grant the service account write access to its own log directory

BeryJu
and
claude
committed
b654fbf
ee/wcp: log the result of the exact CreateMutex call ProcessSingleton makes

BeryJu
and
claude
committed
e19fe56
Merge branch 'main' into ee/wcp/browser-privilege
BeryJu
committed
c704057
ee/wcp: expand the CreateMutex diagnostic and log the token's own identity

BeryJu
and
claude
committed
d63ca1a
Merge branch 'ee/wcp/browser-privilege' of https://github.com/goauthentik/platform into ee/wcp/browser-privilege
BeryJu
committed
81c3fca

Commits on Aug 20, 2026