coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Register coulomb-social OIDC client on live KeyCape (CSOC-WP-0002-T03)

Browse source 
Public PKCE client on kc.coulomb.social with local and production redirect
URIs. Add register-keycape-client.sh, document env, and harden public-client
token exchange (no secret). Authorize probe verified registered vs reject.
This commit is contained in:
tegwick 2026-08-09 01:50:51 +02:00
parent 179b20ceed
commit 76ec8cfe41
7 changed files with 138 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/dev.md
View file

@ -27,17 +27,41 @@ uv run pytest
## Environment
See `.env.example`. Summary:
| Variable | Default | Purpose |
|----------|---------|---------|
| `SECRET_KEY` | insecure dev default | Django secret |
| `DATABASE_URL` | sqlite `./db.sqlite3` | DB |
| `DEFAULT_TENANT_ID` | `binky` | Client #1 tenant key |
| `OIDC_ENABLED` | `false` | Use real NetKingdom issuer |
| `OIDC_ISSUER` | | Issuer base URL |
| `OIDC_CLIENT_ID` / `OIDC_CLIENT_SECRET` | | OIDC client (secret from OpenBao in prod) |
| `OIDC_REDIRECT_URI` | | e.g. `http://127.0.0.1:8008/auth/callback/` |
| `OIDC_ENABLED` | `false` | Use KeyCape / real issuer |
| `OIDC_ISSUER` | | e.g. `https://kc.coulomb.social` |
| `OIDC_CLIENT_ID` | | `coulomb-social` |
| `OIDC_CLIENT_SECRET` | empty | **public client** — leave empty |
| `OIDC_REDIRECT_URI` | | `http://127.0.0.1:8008/auth/callback/` |
| `USER_ENGINE_BASE_URL` | empty (stub) | user-engine HTTP |
| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id in user-engine |
| `FLEX_AUTH_BASE_URL` | empty (fail-closed except shell:view) | PDP |
### Platform OIDC (KeyCape)
Client is registered on railiance01 KeyCape. Re-apply if redirect URIs change:
```bash
./scripts/register-keycape-client.sh
```
Then:
```bash
export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
export OIDC_SCOPES="openid profile email groups"
make run
```
Sign-in redirects to Authelia (`auth.coulomb.social`) + MFA via privacyIDEA.
See `docs/adr/ADR-0001-netkingdom-identity.md` and `docs/identity/`.

48
docs/identity/oidc-client.md
View file

@ -5,21 +5,45 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
| Field | Value / notes |
|-------|----------------|
| Application | coulomb.social |
| Profile | NetKingdom IAM Profile (PKCE required) |
| client_id | set per environment (`OIDC_CLIENT_ID`) |
| client_secret | OpenBao / local 0600 only — never Git |
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` |
| redirect_uri (prod) | `https://coulomb.social/auth/callback/` (confirm at deploy) |
| scopes | `openid profile email` (+ profile claims as issuer provides) |
| grant | authorization_code + PKCE S256 |
| wildcard redirects | **forbidden** (KeyCape constraint) |
| Profile | NetKingdom IAM Profile (PKCE S256 required) |
| Issuer (live) | `https://kc.coulomb.social` (KeyCape lightweight mode) |
| client_id | `coulomb-social` |
| client_type | **public** (no client secret; PKCE only) |
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` · `http://localhost:8008/auth/callback/` |
| redirect_uri (prod) | `https://coulomb.social/auth/callback/` |
| scopes | `openid profile email groups` |
| grant | authorization_code |
| wildcard redirects | **forbidden** |
## Status
| Environment | Issuer mode | Registered |
|-------------|-------------|------------|
| local | dev claims (`OIDC_ENABLED=false`) | n/a |
| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |
| local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **yes** (2026-08-09) |
| key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
When registering, record the live client_id here (not the secret) and the
issuer base URL in deploy notes.
### Live verification (2026-08-09)
- Registered via `scripts/register-keycape-client.sh` →
`net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh` (patches
`sso/keycape-config`, rolls out KeyCape).
- `GET /authorize` with registered redirect → **200**, browser handoff to Authelia.
- Unregistered redirect → **400** `invalid_profile_usage` / `redirect_uri does not match`.
### Enable in the app
```bash
export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
# leave OIDC_CLIENT_SECRET unset (public client)
make run
```
Re-register after redirect URI changes:
```bash
./scripts/register-keycape-client.sh
```