tegwick
01da195c13
Django scaffold aligned with the business delivery lane: tenant-keyed Member model without passwords, identity app as sole OIDC/session boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP, flex-auth, and packaging remain open.
25 lines
1 KiB
Markdown
25 lines
1 KiB
Markdown
# OIDC client binding (coulomb.social)
|
|
|
|
Non-secret registration checklist for NetKingdom IAM Profile issuers.
|
|
|
|
| Field | Value / notes |
|
|
|-------|----------------|
|
|
| Application | coulomb.social |
|
|
| Profile | NetKingdom IAM Profile (PKCE required) |
|
|
| client_id | set per environment (`OIDC_CLIENT_ID`) |
|
|
| client_secret | OpenBao / local 0600 only — never Git |
|
|
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` |
|
|
| redirect_uri (prod) | `https://coulomb.social/auth/callback/` (confirm at deploy) |
|
|
| scopes | `openid profile email` (+ profile claims as issuer provides) |
|
|
| grant | authorization_code + PKCE S256 |
|
|
| wildcard redirects | **forbidden** (KeyCape constraint) |
|
|
|
|
## Status
|
|
|
|
| Environment | Issuer mode | Registered |
|
|
|-------------|-------------|------------|
|
|
| local | dev claims (`OIDC_ENABLED=false`) | n/a |
|
|
| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |
|
|
|
|
When registering, record the live client_id here (not the secret) and the
|
|
issuer base URL in deploy notes.
|