tegwick
1272c699b0
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
71 lines
3.1 KiB
Markdown
71 lines
3.1 KiB
Markdown
# OIDC client binding (coulomb.social)
|
|
|
|
Non-secret registration checklist for NetKingdom IAM Profile issuers.
|
|
|
|
| Field | Value / notes |
|
|
|-------|----------------|
|
|
| Application | coulomb.social |
|
|
| Profile | NetKingdom IAM Profile (PKCE S256 required) |
|
|
| Issuer (live) | `https://kc.coulomb.social` (KeyCape lightweight mode) |
|
|
| client_id | `coulomb-social` |
|
|
| client_type | **public** (no client secret; PKCE only) |
|
|
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` · `http://localhost:8008/auth/callback/` |
|
|
| redirect_uri (public app) | `https://app.coulomb.social/auth/callback/` (**live** host while Bubble keeps apex) |
|
|
| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (historical descriptor; cutover deferred) |
|
|
| scopes | `openid profile email groups` |
|
|
| grant | authorization_code |
|
|
| wildcard redirects | **forbidden** |
|
|
|
|
## Status
|
|
|
|
| Environment | Issuer mode | Registered |
|
|
|-------------|-------------|------------|
|
|
| local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
|
|
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **restored** (founder-approved guarded repair 2026-10-06; interactive acceptance pending) |
|
|
| key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
|
|
|
|
### Historical verification (2026-08-09)
|
|
|
|
- Registered via `scripts/register-keycape-client.sh` →
|
|
`net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh` (patches
|
|
`sso/keycape-config`, rolls out KeyCape).
|
|
- `GET /authorize` with registered redirect → **200**, browser handoff to Authelia.
|
|
- Unregistered redirect → **400** `invalid_profile_usage` / `redirect_uri does not match`.
|
|
|
|
### Enable in the app
|
|
|
|
```bash
|
|
export OIDC_ENABLED=true
|
|
export OIDC_ISSUER=https://kc.coulomb.social
|
|
export OIDC_CLIENT_ID=coulomb-social
|
|
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|
# leave OIDC_CLIENT_SECRET unset (public client)
|
|
make run
|
|
```
|
|
|
|
Inspect current registration (read-only default):
|
|
|
|
```bash
|
|
./scripts/register-keycape-client.sh
|
|
```
|
|
|
|
### Current repair — 2026-10-06
|
|
|
|
User tegwick reports invalid_profile_usage / unknown client_id. Guarded live
|
|
inspection confirms the missing client; server dry-run passes. The wrapper now
|
|
uses NetKingdom's byte-preserving CAS helper and executes Kubernetes operations
|
|
on railiance01 through SSH, suppressing Secret output/errors. It refuses differing
|
|
registrations. Explicit `dry-run` / `apply` modes require the fresh inspection's
|
|
`--expected-uid` and `--expected-resource-version`. Apply and issuer restart need
|
|
founder approval; the wrapper never restarts the issuer automatically.
|
|
|
|
See [release review](../release/personal-account-2026-10-06.md) and
|
|
[ordinary-session assurance close-down](../security-close-down-checklist.md).
|
|
|
|
### Deployed repair — 2026-10-06
|
|
|
|
Founder approved the exact repair. Guarded CAS/readback succeeded; KeyCape
|
|
restart completed. Discovery returns 200 and authorization hands off to Authelia
|
|
with 302, without the missing-client error. The upgraded app emits the correct
|
|
client ID, callback and S256 PKCE challenge. Interactive tegwick login remains
|
|
pending the user's confirmation. See docs/release/personal-account-deployed-2026-10-06.md.
|