Post B5ZBVkhfJUejG3nmoy by astraluma@tacobelllabs.net
 (DIR) More posts by astraluma@tacobelllabs.net
 (DIR) Post #B5Z8jyDHa4JDLlg8sC by star@amazonawaws.com
       0 likes, 0 repeats
       
       one can only write so much specification document involving OIDC in one dayand that is goodno one should have to do more of this
       
 (DIR) Post #B5Z9HlfkiItWIk6xbk by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star *sobs in CICD integrator*
       
 (DIR) Post #B5Z9kEbWjtFM8ki0Z6 by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma i have seen ci pipelines you wouldn't believe ​:neodog_sip_nervous:​
       
 (DIR) Post #B5Z9mbnJUR1GdsLzqS by star@amazonawaws.com
       0 likes, 0 repeats
       
       codeberg.org/polyphony/polyproto-dot-org/commit/eac734612bdedb70f8b53ccbf1ab6da592ecf799
       
 (DIR) Post #B5Z9qDMoFiuq2XfzdI by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star oh no
       
 (DIR) Post #B5Z9zl9pzMINRk9zbU by star@amazonawaws.com
       0 likes, 0 repeats
       
       This clears another big blocker in integrating OIDC into polyproto. One of the last big ones, actually
       
 (DIR) Post #B5ZABUVFjgOdGglrPs by star@amazonawaws.com
       0 likes, 0 repeats
       
       Specifically, the commit translates a concept which already existed previously in the spec, called "sensitive solutions", to work with OIDC. What we call "sensitive solutions" is basically the "enter your password to confirm this action" you already know from other applications, but in polyproto. :3
       
 (DIR) Post #B5ZAKvbsK4I3wdMuSO by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star love a good sudo dialog
       
 (DIR) Post #B5ZAMsIvaG1wGuQzDs by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma sudo but they send you straight to AzureAD >:3
       
 (DIR) Post #B5ZASjAeSG69gMM0Dg by astraluma@tacobelllabs.net
       0 likes, 0 repeats
       
       @star reading through this, and i'm like "wait, OIDC already has a discovery and validation mechanism"but then I realized it's for bootstrap, if I'm skimming it right?
       
 (DIR) Post #B5ZASjZowgEOwQ86S0 by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma what do you mean with "discovery and validation" and "bootstrap"? /genq
       
 (DIR) Post #B5ZBMItnJuAQPyyCMy by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star so, given nothing but an OIDC JWT, there's a method to validate the issuer keys, and that whomever signed the token had access to the keys published (based on trusting DNS and TLS PKI).But that assumes you're validating & evaluating a token that already exists. I think oidc_issuer is about bootstrap to get a token?
       
 (DIR) Post #B5ZBMJ7GVowV5lGxMm by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma oidc_issuer is just to tell the client where the IdP can be contacted
       
 (DIR) Post #B5ZBMJxjMkuTiTor8y by astraluma@tacobelllabs.net
       0 likes, 0 repeats
       
       @star note that "this token is self-consistent and correctly signed" is different from "I trust this token and its issuer"
       
 (DIR) Post #B5ZBVkhfJUejG3nmoy by astraluma@tacobelllabs.net
       0 likes, 0 repeats
       
       @star yeah, "Hi, I'm a client and I know nothing, can you tell me the shape of your world?" aka bootstrap
       
 (DIR) Post #B5ZBVkvqSlzxy2R6vI by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma ahh, yessorry, it is late and my brain is completely fried from spec writing, xD
       
 (DIR) Post #B5ZCOeEH5Lk96eENbU by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star it's cooli had to know all this because Teahouse Hosting uses CI/CD OIDC for authenticating automations & pipelines
       
 (DIR) Post #B5ZCPxpzfR2mD5V98q by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma That's very cool! :3 ​:neocat_owo:​
       
 (DIR) Post #B5ZHaNjqis9tCtPkem by astraluma@tacobelllabs.net
       1 likes, 0 repeats
       
       @star it feels so slick and was in some ways easier to implement than a long-lived token system
       
 (DIR) Post #B5ZHptPZFJXRmZK8bQ by star@amazonawaws.com
       0 likes, 0 repeats
       
       @astraluma OIDC is pretty neat overall!! I just wish it had more great documentation and a better overview of extensions and who implements them