coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete identity smoke path: id_token claims, registration entry, cutover docs

Browse source 
Prefer verified KeyCape id_token claims when /userinfo returns 401; soft-fail
userinfo. Add CSOC-WP-0003 registration entry (disabled until NetKingdom URL),
AAL step-up hooks, smoke/cutover evidence for tegwick OIDC without MFA.
This commit is contained in:
tegwick 2026-08-09 22:42:51 +02:00
parent 3bc16b581b
commit 29a9ff735e
14 changed files with 513 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.env.example
View file

@ -15,6 +15,10 @@ OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
# Public client — no secret:
# OIDC_CLIENT_SECRET=
OIDC_SCOPES=openid profile email groups
# Ordinary sign-in is AAL1; sensitive actions request this ACR explicitly.
OIDC_STEP_UP_ACR=aal2
# Enable the landing-page registration link when public registration is deployed.
# NETKINGDOM_REGISTRATION_URL=https://users.coulomb.social/register?client_id=coulomb-social
USER_ENGINE_APPLICATION_ID=coulomb-social
USER_ENGINE_EXPECTED_AUDIENCE=user-engine-portal