coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Browse source 
Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.
This commit is contained in:
tegwick 2026-08-09 01:45:05 +02:00
parent 2ec7761504
commit 01da195c13
51 changed files with 2215 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/identity/oidc-client.md Normal file
View file

@ -0,0 +1,25 @@
# OIDC client binding (coulomb.social)
Non-secret registration checklist for NetKingdom IAM Profile issuers.
| Field | Value / notes |
|-------|----------------|
| Application | coulomb.social |
| Profile | NetKingdom IAM Profile (PKCE required) |
| client_id | set per environment (`OIDC_CLIENT_ID`) |
| client_secret | OpenBao / local 0600 only — never Git |
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` |
| redirect_uri (prod) | `https://coulomb.social/auth/callback/` (confirm at deploy) |
| scopes | `openid profile email` (+ profile claims as issuer provides) |
| grant | authorization_code + PKCE S256 |
| wildcard redirects | **forbidden** (KeyCape constraint) |
## Status
| Environment | Issuer mode | Registered |
|-------------|-------------|------------|
| local | dev claims (`OIDC_ENABLED=false`) | n/a |
| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |
When registering, record the live client_id here (not the secret) and the
issuer base URL in deploy notes.