Fixed PEM Keys issue

.vscode/launch.json

@@ -64,9 +64,9 @@
                 "CYGNUS_TOKEN_URL": "http://localhost:8090/oauth2/token",
                 "CYGNUS_CLIENT_ID": "matrix",
                 "CYGNUS_INSTALLATION_ID": "matrix-delhi-cygnus-01",
-                "CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/matrix-installation/config/machine-assertion.jwt",
+                "CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/config/clients/matrix/matrix-matrix-delhi-cygnus-01-assertion.jwt",
                 "CYGNUS_LOGIN_KEY_ID": "cygnus-login-2026-01",
-                "CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/matrix-installation/config/keys/login-public.pem",
+                "CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/config/keys/login-public.pem",
                 "CYGNUS_CLOUD_REQUEST_TIMEOUT": "PT10S",
                 "CYGNUS_TOKEN_REFRESH_SKEW": "PT30S"
             },

.~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx#

@@ -1 +0,0 @@
-,maddy,Narayanans-MacBook-Pro.local,27.07.2026 21:29,file:///Users/maddy/Library/Application%20Support/LibreOffice/4;

cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java

@@ -30,6 +30,7 @@ public class DeploymentWriter {
         try {
             Path normalizedOutput = output.toAbsolutePath().normalize();
             Path config = normalizedOutput.resolve("config");
+            protectCloudConfiguration(config, profile);
             Path keyDirectory = config.resolve("keys");
             Files.createDirectories(keyDirectory);
 
@@ -82,6 +83,23 @@ public class DeploymentWriter {
         }
     }
 
+    private void protectCloudConfiguration(Path deploymentConfig, ProductProfile profile) {
+        if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey())
+                || isInside(deploymentConfig, profile.loginEncryptionPublicKey())) {
+            throw new IllegalArgumentException(
+                    "Refusing to write deployment files over the cloud-service "
+                            + "configuration directory");
+        }
+    }
+
+    private boolean isInside(Path directory, Path file) {
+        if (file == null) {
+            return false;
+        }
+        return file.toAbsolutePath().normalize().startsWith(
+                directory.toAbsolutePath().normalize());
+    }
+
     private String installationConfiguration(
             UUID installationUuid,
             String installationCode,

cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java

@@ -156,6 +156,7 @@ public class InstallationService {
         if (request.outputDirectory() == null) {
             throw new IllegalArgumentException("Output directory is required");
         }
+        validateOutputIsolation(request.outputDirectory());
         RuntimeConfiguration runtime = request.runtimeConfiguration();
         if (runtime == null) {
             throw new IllegalArgumentException("Runtime configuration is required");
@@ -204,6 +205,27 @@ public class InstallationService {
         }
     }
 
+    private void validateOutputIsolation(Path outputDirectory) {
+        Path deploymentConfig = outputDirectory
+                .toAbsolutePath()
+                .normalize()
+                .resolve("config");
+        if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey())
+                || isInside(deploymentConfig, profile.loginEncryptionPublicKey())) {
+            throw new IllegalArgumentException(
+                    "Output directory would overwrite the cloud-service config folder. "
+                            + "Select a dedicated deployment directory, such as "
+                            + "'matrix-installation'.");
+        }
+    }
+
+    private boolean isInside(Path directory, Path file) {
+        if (file == null) {
+            return false;
+        }
+        return file.toAbsolutePath().normalize().startsWith(directory);
+    }
+
     private String normalizedCloudServiceUrl(String value) {
         String normalized = value.trim();
         return normalized.endsWith("/")

cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java

@@ -1,6 +1,7 @@
 package com.cygnus.installer;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import java.net.URI;
 import java.nio.file.Files;
@@ -121,4 +122,84 @@ class DeploymentWriterTest {
         assertThat(output.resolve("config/keys/client-signing-private.pem"))
                 .isRegularFile();
     }
+
+    @Test
+    void refusesToOverwriteCloudServiceConfiguration() throws Exception {
+        Path cloudConfig = temporaryDirectory.resolve("config");
+        Path cloudKeys = cloudConfig.resolve("keys");
+        Files.createDirectories(cloudKeys);
+        Path assertionPublic = cloudKeys.resolve("assertion-decryption-public.pem");
+        Path loginPublic = cloudKeys.resolve("login-public.pem");
+        Files.writeString(assertionPublic, "assertion-public-key");
+        Files.writeString(loginPublic, "login-public-key");
+
+        var profile = new ProductProfile(
+                "matrix",
+                "Matrix",
+                "matrix-onprem",
+                "MATRIX_IMAGE",
+                "matrix",
+                "installation.yml",
+                "MATRIX_INSTALLATION_CONFIG",
+                "/srv/matrix/config/installation.yml",
+                "8080:8080",
+                "/matrix/",
+                "/oauth2/token",
+                assertionPublic,
+                loginPublic,
+                "cygnus-login-2026-01",
+                List.of());
+
+        assertThatThrownBy(() -> new DeploymentWriter().write(
+                        temporaryDirectory,
+                        UUID.randomUUID(),
+                        "primary",
+                        "matrix-client",
+                        new ActivationDtos.ValidationResponse(
+                                "activation-token",
+                                OffsetDateTime.now().plusMinutes(5),
+                                UUID.randomUUID(),
+                                "matrix-client",
+                                "FULL",
+                                2),
+                        new ActivationDtos.RegistrationResponse(
+                                UUID.randomUUID(),
+                                UUID.randomUUID(),
+                                UUID.randomUUID(),
+                                null,
+                                "primary",
+                                1,
+                                "ACTIVE"),
+                        new InstallationKeyService().generate(),
+                        "assertion",
+                        new InstallerSettings(
+                                "matrix",
+                                URI.create("https://cloud.example.com"),
+                                URI.create("https://cloud.example.com"),
+                                "/api/v1/installations",
+                                "production",
+                                temporaryDirectory,
+                                temporaryDirectory,
+                                "1",
+                                new IniDocument(Map.of())),
+                        profile,
+                        "registry.example.com/matrix:1.0.0",
+                        Map.of(),
+                        new RuntimeConfiguration(
+                                "https://cloud.example.com",
+                                "jdbc:postgresql://db/matrix",
+                                "postgres",
+                                "secret",
+                                "redis",
+                                "7901",
+                                "secret",
+                                false,
+                                "PT10S",
+                                "PT30S")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("cloud-service configuration");
+
+        assertThat(assertionPublic).hasContent("assertion-public-key");
+        assertThat(loginPublic).hasContent("login-public-key");
+    }
 }

cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java

@@ -1,7 +1,5 @@
 package matrix.nimble.controller;
 
-import java.util.Map;
-
 import matrix.nimble.cloud.identity.CloudAuthenticationException;
 import matrix.nimble.cloud.identity.CloudAuthenticationGateway;
 import matrix.nimble.model.Login;
@@ -27,18 +25,12 @@ public class SessionController {
 	public SessionController(CloudAuthenticationGateway cloudAuthenticationGateway) {
 		this.cloudAuthenticationGateway = cloudAuthenticationGateway;
 	}
-	// @RequestMapping(value="login",method=RequestMethod.POST )
+	@RequestMapping(value="login", method={RequestMethod.GET, RequestMethod.POST})
-	// public String LoginPage(ModelMap model,@RequestHeader Map<String, String> headers)
+	public String LoginPage(ModelMap model)
-	// {
+	{
-	// 	model.addAttribute("login", new Login());
+		model.addAttribute("login", new Login());
-	// 	String host = headers.get("host").toString();
+		return "login";
-	// 	if(!host.contains("192.168.10.205:8585") && 
+	}
-	// 			!host.contains("192.168.10.250:8585") && 
-	// 			!host.startsWith("localhost:") && !host.startsWith("127.0.0.1:")) {
-	// 		return "error";
-	// 	}
-	// 	return "login";
-	// }
 	@RequestMapping(value="logout",method=RequestMethod.POST )
 	public String LogoutPage(HttpServletRequest request, ModelMap model,@ModelAttribute(value="Sessvals") Session Sessvals)
 	{

matrix-installation/.env

@@ -1,17 +0,0 @@
-MATRIX_IMAGE="hub.technobeesolutions.in/matrix-onprem:1.0.0"
-MATRIX_DB_URL="jdbc:postgresql://103.125.129.116:5333/matrix"
-MATRIX_DB_USERNAME="postgres"
-MATRIX_DB_PASSWORD="M@triXR3d1s@6202"
-REDIS_HOST="103.125.129.116"
-REDIS_PORT="7901"
-REDIS_PASSWORD="M@triXR3d1s@6202"
-REDIS_SSL="false"
-CYGNUS_CLOUD_BASE_URL="http://host.docker.internal:8090"
-CYGNUS_TOKEN_URL="http://host.docker.internal:8090/oauth2/token"
-CYGNUS_CLIENT_ID="matrix"
-CYGNUS_INSTALLATION_ID="matrix-delhi-cygnus-01"
-CYGNUS_CLIENT_ASSERTION="file:/opt/matrix/config/machine-assertion.jwt"
-CYGNUS_LOGIN_KEY_ID="cygnus-login-2026-01"
-CYGNUS_LOGIN_PUBLIC_KEY="file:/opt/matrix/config/keys/login-public.pem"
-CYGNUS_CLOUD_REQUEST_TIMEOUT="PT10S"
-CYGNUS_TOKEN_REFRESH_SKEW="PT30S"

matrix-installation/compose.yml

@@ -1,12 +0,0 @@
-services:
-  matrix-onprem:
-    image: ${MATRIX_IMAGE:?Set MATRIX_IMAGE}
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - ./config:/opt/matrix/config:ro
-    env_file:
-      - ./.env
-    environment:
-      MATRIX_INSTALLATION_CONFIG: /opt/matrix/config/installation.yml

matrix-installation/config/installation.yml

@@ -1,13 +0,0 @@
-matrix:
-  product: "matrix"
-  cloud-url: "http://host.docker.internal:8090"
-  token-url: "http://host.docker.internal:8090/oauth2/token"
-  tenant-id: "00000000-0000-4000-8000-000000000001"
-  client-id: "matrix"
-  installation-id: "5aecfd98-dcd0-4ac4-b973-2b65b7ceda08"
-  installation-uuid: "579a040e-6803-4648-a9ef-74733cc94a21"
-  installation-code: "matrix-delhi-cygnus-01"
-  environment: "production"
-  machine-assertion: "file:./config/machine-assertion.jwt"
-  signing-private-key: "file:./config/keys/client-signing-private.pem"
-  signing-public-key: "file:./config/keys/client-signing-public.pem"

matrix-installation/config/keys/client-signing-private.pem

@@ -1,40 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDoPaKADkY3b17L
-Qx1lHpmR/VRl+ypyYnefVvHTqEiJ9fC5epsn+GUFLA4F4IyhDECpwMNOlW0GkFzP
-ZpIlFCLXaHaMrCNVQNL2oZXDoFcK6IEod9F5dK0gjdFvDCKROhNfVQJ6wtLmgF9o
-AO946i0vUfpdMGr+p2LF4Jqyo5y7BlKF+Vq1wFipCG2qaEqMiyOHd7QJ7+aPbKaZ
-XdYlh410I7gOefOd7C8VMNl8bHQmpKh4i987NlNaN3tLR2tfLw2N1xWAijXpYXe8
-lzNaCtA1cVnEOIsLwmFoQ61jfSIH11h8ZqxIXFt/0gfSUNoM3cn+ujm6x4gwqbcN
-z3uzglhewHJvCVuzmlZRr1iAjz9jOo1Q9tJMEon2Jr41Wopby18mgwk6xoceZMrN
-ApRiONA9IkT1F5N6F6jwQjZFkEEgKq5X30ayIfTT9Ya57b+4BBEW6gYPEnwcaMPa
-S/5L1IxkZ1zAVM9Fs4vw7OLzwO+oIm1HfpDiBidTf6McLDFWhPECAwEAAQKCAYAK
-o3Un0M+UX0KMRN4qOUs/YeeNduKYRAy3BL5168fr4vNkqbpFC9bD1INtbz5965/k
-Ls97kHKCuhb4TLpt3qTkcXV5xvJk57/qOpdv007dce5ltkxnGApMuxZglAGa3bpQ
-tAYVrcpHsxJ7www1QaPxfpu9jFfgY7ZNencXrxFBS345AyXNvNqK3rcYVufwVXja
-jigWCvJouElO7fqe9D1NeEvohNtdLPowqjDSR20QLpuFjyG6Fohdsfwww/wmC3OJ
-BdO9KyBeq7RA5cTYsCOstfp1vPc8iuTUCmsLqp7DUfuHe4CdxphmTPxZ5uBzpnw4
-9xECl6nGC/U94Utm+uz3EqF+ZcRX+TWyTNVnay86OXNIgYFHfxz/uf3/9dBy1yud
-R7c8cw4bzdxPTXtXUHSgRZK/A9xNshOKiMVpw9AufkMZy/ddT44GDAmkPcJfExIN
-ybr0Hn10DHPpTyghYOSOEfd/+Onh5ZwgO+kIPRtJud9MRjDVYAjBG0GZr3JE28EC
-gcEA7FWbIW9z4VVxbmMV9yiAmeFlXRLUSFED7GBY9kemBf0lT34Sjz/8dxCD9EQg
-qusKf/4djmDI7WnTWrO9WEt2Xi98PnPiOlwb6P4PkLwcswLcRhnlzYEGl873Swrd
-bUFS1CbS3yPOjILmlsqir8bKE1LO76P+ZPPa33TpcUB9hdeW9Lx27mkxrw+i0IGX
-3WSu5l68IlNERG5CgDd93FNN/TS9VNddvzuTAWcvmYB1YuRGjlQQ5p4dG1AtH1Vg
-N9URAoHBAPuQ034lCmyT1AdGoVQXI3slQ4HP5kf03fa+yywvUZxAAd6M/NRDS0U5
-ZVlo15Ehf8S4ICrv2yk4uSbPW4tP9S2XxGYMkc8mqDJvX3LcQgX0eXrt/yiMP3kT
-oqK9jrXt3+YT/Bo6T1rlBrOQ8jclveryfvpjjkxwXtmB/3kagUmjzglvDZs+yyE5
-3jelxO4k9pvLEB9h7xz7pjMNHr3j2KTIxZA6jG8zUKmuPxooTOtnnPlFWgpnhySa
-i8pf+Lwx4QKBwEHKQvk30YZ1BrK4GrFHMSWlPVZ/m2DWTMVMvPcyUuFv6ycJ7Zi7
-M0jh7BnfrUhnTfD7iLbN8qFEyHWDe75Mo5LsnSW1lNCyO4LM1wBvnX2n2jIZm4Nt
-26v/DZByYdm8SZaNiD5d9W3gMtjfaBKOwEpIzxqfCH6J8/Ao16OTVF4h+f//Rwxv
-dElLjQOGUARtttKipLTZgTObjh+rUvo2potKVzp7Cbnml7HYS8ProsH40jtk45+P
-fILR+v2yAqsIQQKBwG8q69sFwVqD5SGl+6ruYraLnA5kcg4AToo4fA41hun2exz+
-zsd6SWv41imxo/k1hYHIICb5Qa8wqtlUrs6ccetI8vhpu5GAMrm+774RSXfaNki1
-nZksiOwXWjpya/tHeDbzQ+fPNrwjE1gMyIzIN+n4aVZ64iozSibyRJQeu11wbp9K
-nQeqsxcmvGV48tKOMRBdpu1HWORE7IgI1znw0w7Wzj9TMDX/xjiFkMsdXgh1DDA3
-jnekklsBlJ7E1GVN4QKBwQCWZTs5UcE+0At58AyN3fK+g3f0Bon9TNhqmmQ+ZB/N
-StWe1Kc95DlS75jeEMX6xEhdXX7VMNbLEvNroh8xA307x/zWs4znkbsY1ONg16W/
-beqEfnr7szk/3KcLh6UE0FswHDxMZwprNhYDT/Eo5GLC4uzIE6wy2Nznmhh6IJ2R
-Ujv6Wh5+nvLX0M+RzZaNj2WI5j1kkA6EwQFVS7srBQlqChRGa2n7pOV1UxRKjfsf
-SO8FID8TwwH38mtCqMgIDLU=
------END PRIVATE KEY-----

matrix-installation/config/keys/client-signing-public.pem

@@ -1,11 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA6D2igA5GN29ey0MdZR6Z
-kf1UZfsqcmJ3n1bx06hIifXwuXqbJ/hlBSwOBeCMoQxAqcDDTpVtBpBcz2aSJRQi
-12h2jKwjVUDS9qGVw6BXCuiBKHfReXStII3RbwwikToTX1UCesLS5oBfaADveOot
-L1H6XTBq/qdixeCasqOcuwZShflatcBYqQhtqmhKjIsjh3e0Ce/mj2ymmV3WJYeN
-dCO4DnnznewvFTDZfGx0JqSoeIvfOzZTWjd7S0drXy8NjdcVgIo16WF3vJczWgrQ
-NXFZxDiLC8JhaEOtY30iB9dYfGasSFxbf9IH0lDaDN3J/ro5useIMKm3Dc97s4JY
-XsBybwlbs5pWUa9YgI8/YzqNUPbSTBKJ9ia+NVqKW8tfJoMJOsaHHmTKzQKUYjjQ
-PSJE9ReTeheo8EI2RZBBICquV99GsiH00/WGue2/uAQRFuoGDxJ8HGjD2kv+S9SM
-ZGdcwFTPRbOL8Ozi88DvqCJtR36Q4gYnU3+jHCwxVoTxAgMBAAE=
------END PUBLIC KEY-----

matrix-installation/config/keys/login-public.pem

@@ -1,11 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvbjaZHePDwZQj1R1s23I
-CSR6SzUi707WsGHoJZLLcFruXGTreNWIonU8Ye+iHwCUIJVhhoz0d7eGdfUc70ZO
-Kn7dKfTfdsiWJi5RiM6loUk8iSAjrgh07chUgyL6luak7ZNevmWTCkSIuvVV9UZe
-ZiH5Xh99zXr6Y0cLs7TcB0Tfc3y72dtU9VLjqhcc7KYibzHDWWfwVcpG7mkmmkEM
-2tDHGmiZGoKk9uJoSMesh4w7XPE+UHxMEsK2wXpZLrwlN9ikxk56Cd/Z016MkkXZ
-mMAofaTQ8NtfV/UuJjALUER0REJ8jb3qXBq5Pgh2ZkpmSaysZQPpNdll5SSHjhVV
-t/UQ2QNgZiBh5bHZGpZJIvZ4E3RQ1Dtj2Q/QtSKgbffY3owNLu+2Lb/qQ90JV580
-dMg8D+89uy+MOL8JpQxHvTjKk5tqFlBhmVo+Y9i2KfPgv3rM1R3q+A4j9hN37x+a
-f2tulHI5quy0KLbANp/32qlVVgd6TgnMikWCkwNpo7YZAgMBAAE=
------END PUBLIC KEY-----

matrix-installation/config/machine-assertion.jwt

@@ -1 +0,0 @@
-eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.D21KmNzi4shZx538-fArwUt0frd6nViAjl3E4ptHYfVlxWb5700VrK5HuLBl5fi2mG2e7ymeEGun83Qg7NMCl0-H9Df5vmjDwoQWzzVPS2TEcn0PhsyrHXWi7d3H2pHZUT9o8vHcVRSg9ROIofrwO-yUzGSixDxoEeIRQm3k3MSuuGOBp6MwTGthskPpAhYTJbFs9LNvMgJGJb3Sg4F0Ycz2bSFP_eqfIwKvkCcDOh-sjXK-1F0bDuZpeG0-Wh3L6uX7tdQmAm6NIm1sxVKB9dKwff_oryMGu-PgsIzeiGwCD50UelQVe1LLGayew_ysNt8PoGnVAJQrXMsF9tZG11dcQiqS8Xze78U6Z2seiEhGAchE5A3UB60FHkY_iJ7JA_k9u-AhH994KF0eUGI8zcIFCj53vc2oNd6ortVq1CPyUn9GD3QD8xEIfrRreYWI94Fhf5od_i2YduMtVzY-MhGFTjElNKdnfaajCVQIRb-sMDOmxSDgeT_uVYiAcAU_.PQaHgpGtExOh36HB.9k2OZPRwFc5etToeQtTJ9cjT5n3RwMTnffLIw56Co0eEEZ-szIBJXiwdqJoOpp5MG7uz8kNXSwhfnz1v5JTD6FEqpJ0886wr30eJTpQE9Mi0XIwrzFS0IddAa4lgdOcgY_mgs4HQv9TAy-0a9eg7tZwpLjGutTCZHMW5oS_mzr-DIw2qkEanpK8M2ZH6uO8P15h2E2D-WPPCZ4lJes7qA5tOaU8c5UlauWtkTR0HL-pQw348UincBIYwap5dT5j1ToUrkhXUzo_rxfFdZ9H8_jEOnFbaltOH90aVhIMKGDfqKWQIgjdEXA8VgwfdcfwJxKuF-Jhz7FpRyEEoXDM4ios4D9a576dqM_1AtnsgmmHuCGvsgZ3aEuZlWDjOJT7-qkvWEDg4_tuiLYZV69ZIUNzUwxS9uqPizO_W79yV-e0DblGH0lSZwToFq3UHhorxXxAGn4hCqgW5l5xqjrF_sfooZwLYi9v2BKONRj_2TrVbbM7g7EJ4eoaEVftBzdTSARMogpR8NzNUTNcl08p59kiYsbx2yOFtBP6G6_jicjeyv-8fPopmPcLzpo0XCX6dF_toSL3bQsmcTSwmtv70lxKJk383cATJjVjI9ulDeOJbB5_ebudIkIFmQ_gMJuXp5A1rVC9aV_-Ppfq7lmtVv-o3SIft_qh_ihdOe8UxA99yt3IWq9-pfwQry0cH5gGqG4g43-CTNyt4xl_xAYEgFyBG9on2r6hIEFdQ7OJw32V308m3xPI-gHp5_z2yn82cBNskImS56a6ffj05kDuI-1e_1s1EhAZW8X-Z-weWCCv00Co2P1haS_9MjzGfcRW06tbAxsyrJ8xy8yIp97_8S9sgCHeYr3ig7CCDTnOCCIW5jwcFJDF8jWYP8H_3oKpAqgUH867Ar-eAktF4z6Kv6NGji4h4dCPWLGNdD_CglfM6ST0BKizE45leiyxEEDIkIuwBD7lxcy_ItJdVs9ejew.2oEBIqW9A6rXQbyMWu85ew

scripts/setup-local-communication.sh

@@ -228,41 +228,31 @@ register_client_in_database() {
     -d "${DB_NAME_VALUE}" \
     -X -v ON_ERROR_STOP=1 \
     -c "
-      WITH account AS (
+      WITH registration AS (
+        SELECT registration_id
+          FROM identity.client_registration_details
+         WHERE lower(client_code) = lower(
+           convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'))
+           AND status = 'ACTIVE'
+         ORDER BY created_at
+         LIMIT 1
+      ), account AS (
         INSERT INTO identity.client_account
-          (tenant_id, client_slug, client_name, status)
+          (tenant_id, registration_id, client_slug, client_name, status)
-        VALUES (
+        SELECT
           gen_random_uuid(),
+          registration_id,
           convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
           convert_from(decode('${client_name_b64}', 'base64'), 'UTF8'),
-          'ACTIVE')
+          'ACTIVE'
+        FROM registration
         ON CONFLICT (client_slug) DO UPDATE SET
+          registration_id = EXCLUDED.registration_id,
           client_name = EXCLUDED.client_name,
           status = 'ACTIVE',
           updated_at = now()
         RETURNING tenant_id
-      ), installation AS (
+      ), new_license AS (
-        INSERT INTO identity.client_installation
-          (installation_id, tenant_id, client_id, installation_code,
-           assertion_public_key, allowed_scopes, enabled)
-        SELECT
-          gen_random_uuid(),
-          tenant_id,
-          convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
-          convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
-          convert_from(decode('${public_key_b64}', 'base64'), 'UTF8'),
-          ARRAY['identity.login']::text[],
-          true
-        FROM account
-        ON CONFLICT (client_id, installation_code) DO UPDATE SET
-          tenant_id = EXCLUDED.tenant_id,
-          assertion_public_key = EXCLUDED.assertion_public_key,
-          allowed_scopes = EXCLUDED.allowed_scopes,
-          enabled = true,
-          security_version = identity.client_installation.security_version + 1,
-          updated_at = now()
-        RETURNING tenant_id
-      )
         INSERT INTO identity.client_license
           (license_id, tenant_id, license_type, package_code,
            valid_from, valid_until, status)
@@ -274,14 +264,84 @@ register_client_in_database() {
           now(),
           now() + make_interval(months => ${LICENSE_MONTHS}),
           'ACTIVE'
-      FROM installation
+        FROM account
         WHERE NOT EXISTS (
           SELECT 1
             FROM identity.client_license existing
-         WHERE existing.tenant_id = installation.tenant_id
+           WHERE existing.tenant_id = account.tenant_id
              AND existing.status = 'ACTIVE'
              AND existing.valid_until > now()
-      );"
+        )
+        RETURNING license_id, tenant_id
+      ), selected_license AS (
+        SELECT existing.license_id, existing.tenant_id
+          FROM identity.client_license existing
+          JOIN account ON account.tenant_id = existing.tenant_id
+         WHERE existing.status = 'ACTIVE'
+           AND existing.valid_until > now()
+        UNION ALL
+        SELECT license_id, tenant_id
+          FROM new_license
+        ORDER BY license_id
+        LIMIT 1
+      ), installation AS (
+        INSERT INTO identity.client_installation
+          (installation_id, tenant_id, client_id, installation_code,
+           assertion_public_key, allowed_scopes, enabled, license_id,
+           installation_uuid, installation_name, status,
+           software_version, environment)
+        SELECT
+          gen_random_uuid(),
+          account.tenant_id,
+          convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
+          convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
+          convert_from(decode('${public_key_b64}', 'base64'), 'UTF8'),
+          ARRAY['identity.login']::text[],
+          true,
+          selected_license.license_id,
+          gen_random_uuid(),
+          convert_from(decode('${client_name_b64}', 'base64'), 'UTF8')
+            || ' ' ||
+          convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
+          'ACTIVE',
+          'development',
+          'development'
+        FROM account
+        JOIN selected_license
+          ON selected_license.tenant_id = account.tenant_id
+        ON CONFLICT (client_id, installation_code) DO UPDATE SET
+          tenant_id = EXCLUDED.tenant_id,
+          assertion_public_key = EXCLUDED.assertion_public_key,
+          allowed_scopes = EXCLUDED.allowed_scopes,
+          enabled = true,
+          license_id = EXCLUDED.license_id,
+          status = 'ACTIVE',
+          security_version = identity.client_installation.security_version + 1,
+          updated_at = now()
+        RETURNING tenant_id
+      )
+      SELECT count(*) AS provisioned_installations
+        FROM installation;"
+
+  local installation_count
+  installation_count="$(
+    PGPASSWORD="${DB_PASSWORD_VALUE}" "${PSQL_BIN}" \
+      -h "${DB_HOST_VALUE}" \
+      -p "${DB_PORT_VALUE}" \
+      -U "${DB_USER_VALUE}" \
+      -d "${DB_NAME_VALUE}" \
+      -X -A -t \
+      -c "
+        SELECT count(*)
+          FROM identity.client_installation
+         WHERE client_id =
+               convert_from(decode('${client_id_b64}', 'base64'), 'UTF8')
+           AND installation_code =
+               convert_from(decode('${installation_b64}', 'base64'), 'UTF8')
+           AND enabled = true;"
+  )"
+  [[ "${installation_count//[[:space:]]/}" == "1" ]] || fail \
+    "No active registration/account was found for '${CLIENT_ID}'. Create or activate client_registration_details first."
 }
 
 generate_machine_assertion() {