User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
one can only write so much specification document involving OIDC in one day

and that is good

no one should have to do more of this
2
0
4
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star sobs in CICD integrator
1
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma i have seen ci pipelines you wouldn't believe neodog_sip_nervous
1
0
1
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star oh no
0
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
codeberg.org/polyphony/polyproto-dot-org/commit/eac734612bdedb70f8b53ccbf1ab6da592ecf799
2
1
3
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
This clears another big blocker in integrating OIDC into polyproto. One of the last big ones, actually
1
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
Specifically, the commit translates a concept which already existed previously in the spec, called "sensitive solutions", to work with OIDC. What we call "sensitive solutions" is basically the "enter your password to confirm this action" you already know from other applications, but in polyproto. :3
1
0
1
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star love a good sudo dialog
1
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma sudo but they send you straight to AzureAD >:3
1
0
0
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star sudon't!
0
0
0
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star reading through this, and i'm like "wait, OIDC already has a discovery and validation mechanism"

but then I realized it's for bootstrap, if I'm skimming it right?
1
0
0
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma what do you mean with "discovery and validation" and "bootstrap"? /genq
1
0
0
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star so, given nothing but an OIDC JWT, there's a method to validate the issuer keys, and that whomever signed the token had access to the keys published (based on trusting DNS and TLS PKI).

But that assumes you're validating & evaluating a token that already exists. I think oidc_issuer is about bootstrap to get a token?
2
0
1
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star note that "this token is self-consistent and correctly signed" is different from "I trust this token and its issuer"
0
0
0
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma oidc_issuer is just to tell the client where the IdP can be contacted
1
0
0
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star yeah, "Hi, I'm a client and I know nothing, can you tell me the shape of your world?" aka bootstrap
1
0
0
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma ahh, yes

sorry, it is late and my brain is completely fried from spec writing, xD
1
0
2
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star it's cool

i had to know all this because Teahouse Hosting uses CI/CD OIDC for authenticating automations & pipelines
1
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma That's very cool! :3 neocat_owo
1
0
0
0
User avatar
AstraLuma @astraluma@tacobelllabs.net
5mo
@star it feels so slick and was in some ways easier to implement than a long-lived token system
1
0
1
0
User avatar
celeste_hearts_lesbianceleste_hearts_transceleste_hearts_demisexual flori_ava_star:~cursor_blinking @star@amazonawaws.com
5mo
@astraluma OIDC is pretty neat overall!! I just wish it had more great documentation and a better overview of extensions and who implements them
0
0
1
0