tegwick
01da195c13
Django scaffold aligned with the business delivery lane: tenant-keyed Member model without passwords, identity app as sole OIDC/session boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP, flex-auth, and packaging remain open.
1 KiB
1 KiB
OIDC client binding (coulomb.social)
Non-secret registration checklist for NetKingdom IAM Profile issuers.
| Field | Value / notes |
|---|---|
| Application | coulomb.social |
| Profile | NetKingdom IAM Profile (PKCE required) |
| client_id | set per environment (OIDC_CLIENT_ID) |
| client_secret | OpenBao / local 0600 only — never Git |
| redirect_uri (dev) | http://127.0.0.1:8008/auth/callback/ |
| redirect_uri (prod) | https://coulomb.social/auth/callback/ (confirm at deploy) |
| scopes | openid profile email (+ profile claims as issuer provides) |
| grant | authorization_code + PKCE S256 |
| wildcard redirects | forbidden (KeyCape constraint) |
Status
| Environment | Issuer mode | Registered |
|---|---|---|
| local | dev claims (OIDC_ENABLED=false) |
n/a |
| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |
When registering, record the live client_id here (not the secret) and the issuer base URL in deploy notes.