tegwick
76ec8cfe41
Public PKCE client on kc.coulomb.social with local and production redirect URIs. Add register-keycape-client.sh, document env, and harden public-client token exchange (no secret). Authorize probe verified registered vs reject.
26 lines
983 B
Bash
Executable file
26 lines
983 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Register this app's OIDC client on live KeyCape (kc.coulomb.social).
|
|
# Delegates to net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
NK_SCRIPT="${NET_KINGDOM_KEYCAPE_DIR:-$HOME/net-kingdom/sso-mfa/k8s/keycape}/register-coulomb-social.sh"
|
|
|
|
if [[ ! -x "$NK_SCRIPT" && ! -f "$NK_SCRIPT" ]]; then
|
|
echo "ERROR: KeyCape register script not found: $NK_SCRIPT" >&2
|
|
echo "Clone net-kingdom or set NET_KINGDOM_KEYCAPE_DIR." >&2
|
|
exit 1
|
|
fi
|
|
|
|
chmod +x "$NK_SCRIPT" 2>/dev/null || true
|
|
bash "$NK_SCRIPT"
|
|
|
|
echo ""
|
|
echo "Next: export OIDC settings and restart the app:"
|
|
echo " export OIDC_ENABLED=true"
|
|
echo " export OIDC_ISSUER=https://kc.coulomb.social"
|
|
echo " export OIDC_CLIENT_ID=coulomb-social"
|
|
echo " export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/"
|
|
echo " # no client secret — public + PKCE"
|
|
echo " make run"
|
|
echo "Docs: $ROOT/docs/identity/oidc-client.md"
|