tegwick
76ec8cfe41
Public PKCE client on kc.coulomb.social with local and production redirect URIs. Add register-keycape-client.sh, document env, and harden public-client token exchange (no secret). Authorize probe verified registered vs reject.
1.7 KiB
1.7 KiB
OIDC client binding (coulomb.social)
Non-secret registration checklist for NetKingdom IAM Profile issuers.
| Field | Value / notes |
|---|---|
| Application | coulomb.social |
| Profile | NetKingdom IAM Profile (PKCE S256 required) |
| Issuer (live) | https://kc.coulomb.social (KeyCape lightweight mode) |
| client_id | coulomb-social |
| client_type | public (no client secret; PKCE only) |
| redirect_uri (dev) | http://127.0.0.1:8008/auth/callback/ · http://localhost:8008/auth/callback/ |
| redirect_uri (prod) | https://coulomb.social/auth/callback/ |
| scopes | openid profile email groups |
| grant | authorization_code |
| wildcard redirects | forbidden |
Status
| Environment | Issuer mode | Registered |
|---|---|---|
| local offline | dev claims (OIDC_ENABLED=false) |
n/a |
| platform (railiance01) | KeyCape @ kc.coulomb.social |
yes (2026-08-09) |
| key-cape dev-config | local compose | yes (repo config/dev-config.yaml) |
Live verification (2026-08-09)
- Registered via
scripts/register-keycape-client.sh→net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh(patchessso/keycape-config, rolls out KeyCape). GET /authorizewith registered redirect → 200, browser handoff to Authelia.- Unregistered redirect → 400
invalid_profile_usage/redirect_uri does not match.
Enable in the app
export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
# leave OIDC_CLIENT_SECRET unset (public client)
make run
Re-register after redirect URI changes:
./scripts/register-keycape-client.sh