coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish KEY-WP-0008: registration handoff and client MFA isolation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 34s
Details

Browse source 
Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.
This commit is contained in:
tegwick 2026-08-16 01:05:27 +02:00
parent fff9e39478
commit b6af6c5268
22 changed files with 1636 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

4
config/dev-config.yaml
View file

@ -53,3 +53,7 @@ clients:
allowedScopes: ["openid", "profile", "email", "groups"]
grantTypes: ["authorization_code"]
clientType: "public"
# Ordinary login is AAL1; acr_values=aal2 still forces step-up.
# Other clients keep the provider default (mandatory MFA).
mfaRequired: false
registrationUrl: "https://users.92-205-62-239.nip.io/register"