tegwick
29a9ff735e
Prefer verified KeyCape id_token claims when /userinfo returns 401; soft-fail userinfo. Add CSOC-WP-0003 registration entry (disabled until NetKingdom URL), AAL step-up hooks, smoke/cutover evidence for tegwick OIDC without MFA.
28 lines
1.1 KiB
Text
28 lines
1.1 KiB
Text
# Copy to .env for local overrides (never commit .env).
|
|
# python-decouple loads .env automatically when present.
|
|
|
|
SECRET_KEY=change-me
|
|
DEBUG=true
|
|
DATABASE_URL=sqlite:///db.sqlite3
|
|
DEFAULT_TENANT_ID=tenant:coulomb
|
|
|
|
# --- NetKingdom OIDC (KeyCape) ---
|
|
# Offline shell: leave OIDC_ENABLED=false and use /auth/dev-login/
|
|
OIDC_ENABLED=false
|
|
OIDC_ISSUER=https://kc.coulomb.social
|
|
OIDC_CLIENT_ID=coulomb-social
|
|
OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|
# Public client — no secret:
|
|
# OIDC_CLIENT_SECRET=
|
|
OIDC_SCOPES=openid profile email groups
|
|
# Ordinary sign-in is AAL1; sensitive actions request this ACR explicitly.
|
|
OIDC_STEP_UP_ACR=aal2
|
|
# Enable the landing-page registration link when public registration is deployed.
|
|
# NETKINGDOM_REGISTRATION_URL=https://users.coulomb.social/register?client_id=coulomb-social
|
|
|
|
USER_ENGINE_APPLICATION_ID=coulomb-social
|
|
USER_ENGINE_EXPECTED_AUDIENCE=user-engine-portal
|
|
# Live user-engine (both required for HTTP mode):
|
|
# USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
|
|
# USER_ENGINE_PROXY_SECRET= # from OpenBao / kubectl user-engine-runtime — never commit
|
|
# FLEX_AUTH_BASE_URL=
|