coulomb/coulomb-social
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
coulomb-social/docs/identity/oidc-client.md
tegwick 1272c699b0
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Details
Record deployed personal app and remaining Authelia credential rejection 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
2026-10-06 17:02:16 +02:00

3.1 KiB
Raw Blame History

OIDC client binding (coulomb.social)

Non-secret registration checklist for NetKingdom IAM Profile issuers.

Field Value / notes
Application coulomb.social
Profile NetKingdom IAM Profile (PKCE S256 required)
Issuer (live) https://kc.coulomb.social (KeyCape lightweight mode)
client_id coulomb-social
client_type public (no client secret; PKCE only)
redirect_uri (dev) http://127.0.0.1:8008/auth/callback/ · http://localhost:8008/auth/callback/
redirect_uri (public app) https://app.coulomb.social/auth/callback/ (live host while Bubble keeps apex)
redirect_uri (apex future) https://coulomb.social/auth/callback/ (historical descriptor; cutover deferred)
scopes openid profile email groups
grant authorization_code
wildcard redirects forbidden

Status

Environment Issuer mode Registered
local offline dev claims (OIDC_ENABLED=false) n/a
platform (railiance01) KeyCape @ kc.coulomb.social restored (founder-approved guarded repair 2026-10-06; interactive acceptance pending)
key-cape dev-config local compose yes (repo config/dev-config.yaml)

Historical verification (2026-08-09)

  • Registered via scripts/register-keycape-client.sh → net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh (patches sso/keycape-config, rolls out KeyCape).
  • GET /authorize with registered redirect → 200, browser handoff to Authelia.
  • Unregistered redirect → 400 invalid_profile_usage / redirect_uri does not match.

Enable in the app

export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
# leave OIDC_CLIENT_SECRET unset (public client)
make run

Inspect current registration (read-only default):

./scripts/register-keycape-client.sh

Current repair — 2026-10-06

User tegwick reports invalid_profile_usage / unknown client_id. Guarded live inspection confirms the missing client; server dry-run passes. The wrapper now uses NetKingdom's byte-preserving CAS helper and executes Kubernetes operations on railiance01 through SSH, suppressing Secret output/errors. It refuses differing registrations. Explicit dry-run / apply modes require the fresh inspection's --expected-uid and --expected-resource-version. Apply and issuer restart need founder approval; the wrapper never restarts the issuer automatically.

See release review and ordinary-session assurance close-down.

Deployed repair — 2026-10-06

Founder approved the exact repair. Guarded CAS/readback succeeded; KeyCape restart completed. Discovery returns 200 and authorization hands off to Authelia with 302, without the missing-client error. The upgraded app emits the correct client ID, callback and S256 PKCE challenge. Interactive tegwick login remains pending the user's confirmation. See docs/release/personal-account-deployed-2026-10-06.md.