coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Register coulomb-social OIDC client on live KeyCape (CSOC-WP-0002-T03)

Browse source 
Public PKCE client on kc.coulomb.social with local and production redirect
URIs. Add register-keycape-client.sh, document env, and harden public-client
token exchange (no secret). Authorize probe verified registered vs reject.
This commit is contained in:
tegwick 2026-08-09 01:50:51 +02:00
parent 179b20ceed
commit 76ec8cfe41
7 changed files with 138 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md
View file

@ -126,7 +126,7 @@ migrations; no product domain models beyond auth shell.
```task
id: CSOC-WP-0002-T03
status: todo
status: done
priority: high
state_hub_task_id: "1b1d1162-d44a-45db-b906-05ebd7110f21"
```
@ -144,6 +144,12 @@ Record non-secret binding facts under `docs/identity/oidc-client.md`.
**Done when:** browser authorization code + PKCE login completes against the
chosen issuer in a dev environment; evidence in `docs/identity/`.
2026-08-09: Registered public client `coulomb-social` on live KeyCape
(`kc.coulomb.social`) via `scripts/register-keycape-client.sh`. Authorize
probe: registered redirect → Authelia handoff; bad redirect →
`invalid_profile_usage`. Human MFA browser login remains the final UX check
when running the app with `OIDC_ENABLED=true`.
## T04 — user-engine application onboarding
```task