(Original source. NOTE: some of the work in that doc is not part of Omicron (e.g., RSS parts) and so isn't mentioned here.)

NOTE: Unless a bullet item says otherwise, it's talking about support in Nexus and the API, not support in the CLI and console. CLI and console support are covered in separate bullet points towards the bottom.

• Initial Silos work
  • Introduce concept of Silos #814
  • lookup API should use the correct Silo #850 / use the correct Silo for resource lookups #937
• support for assigning roles to Silo users and resources
  • need to represent role assignments for resources #890
  • add support for assigning roles on Organizations #1002
  • IAM: support assigning roles on Projects #1042
  • IAM: support assigning roles on Silos #1044
  • IAM: support assigning roles on the Fleet #1051
• ssh key management
  • SSH public keys #954
  • Pass SSH public keys through to cloud-init #974
• Integration with customer IDP
  • Support for SAML as a Silo IdP, part 1 #1139
  • Support for SAML as a Silo IdP, part 2 #1210 (includes JIT provisioning (auto-create users on SAML login) and SAML login flow)
  • [DRAFT] Add support for Silo groups #1358
  • get user's display name from IdP #3527
  • implement SAML logout flow #3528
  • Test with PingFederate
• support for silo with local users and passwords #1699
  • initial implementation of local-only users #1784
  • password authentication for local-only users #1841
• set up Recovery Silo and user during rack initialization #2943
• users/groups APIs: read-only for SAML Silos, plus maybe "delete" for administrators
  • add API for listing silo users #1261
  • initial implementation of local-only users #1784
  • Bulk user fetch for list of IDs #1209
  • Group detail and list of users #2051
• Device (CLI, API) authn:
  • API client authentication and token granting #1194
  • Expiration for device authn access tokens #2302
  • implement OAuth refresh tokens #2306
• service accounts
• silo login flow, console and API DNS names
  • populate Silo DNS names in external DNS #2918
  • authn should validate that the user belongs to this endpoint's Silo #3529
  • console needs a password login page for "local only" Silos (Serve unauthed console page at /login/{silo_name}/local #3217 / Username/password login page console#1533)
• Console support for above features
  • role assignments for Organization and Project
  • role assignments for Fleet and Silo
  • ssh keys
  • Silos, IdP setup
• CLI support for above features
  • support --resolve for name resolution and --cacert to specify a ca cert oxide.rs#221
  • Merge strategy for integration workflow oxide.rs#219
  • non-required POST body parameters ignored by progenitor oxide.rs#34
• resolve flow for unprivileged users #1354
• all of authz, tracked under tracking issue for authz work #419
• Strong silo isolation #1340
  • Fleet privileges should not cascade into Silos #1580
  • better flesh out operator privileges in other Silos #1681
  • Depending on the outcome of 1681, enforce that Silo, Organization, and Project policies cannot refer to identities outside the Silo. See Fleet privileges should not cascade into Silos #1580. (edit: updated 1681 to include this)
  • Depending on the outcome of 1681, disallow fleet administrators from reading or modifying the policy on the Silo. See Fleet privileges should not cascade into Silos #1580 for details. Since fleet admins need to be able to modify which group is the "admin" group for a Silo, they may wind up changing the policy, but would not have carte blanche to change it however they like. (edit: updated 1681 to include this)
• want way to delegate Fleet access #3275
• cleanup / bugs
  • stop using Display/FromStr for database representations of per-resource roles #1080
  • clean up "test-privileged", "test-unprivileged" users #1087
  • spoof authn should look up the user's silo #1090
  • authz: fix several bugs #1110
  • clean up Polar file: non-functional changes #1112
  • clean up Polar file: minor functional changes #1113
  • should not be able to assign roles to users you can't see #1332
  • Duplicate (user, role) pairs in resource policy PUT body cause 500 #1185
  • decide whether we want to change "Fleet" in the authz subsystem to something else ("global", "region", or "az?). The way it's used is more like "az" or "region" but it's not yet clear which. This is most important for when roles are assigned on this resource -- everything else we could presumably change later, but that's going to be stored in the database.
  • authz check for modifying resource policy needs work
  • consider revisiting policy representation -- see considerations raised in need to represent role assignments for resources #890
  • consider whether we ought to re-work the schema for roles and role assignments with an eye towards custom roles in the future. For example, we might use uuids to identify roles (rather than (resource_type, role_name) tuple) in the role_assignments table
  • audit the exemption list in the role policy test
  • remove built-in silo, move built-in users to the test suite #2305

CC @jmpesp what have I missed?