docs: finish the OIDC pair — sane ZITADEL defaults and the quasar login slice #11

Merged

nsaspy merged 1 commit from docs/oidc-pair-prompts into main

2026-09-06 23:56:51 +00:00

nsaspy commented

2026-09-06 23:56:50 +00:00

Owner

Completes the two-slice OIDC split the operator asked for:

oidc-zitadel-deploy.md (updated) — deploy the OIDC service AND configure sane defaults: registration + email-verification policy, password/MFA posture, token lifetimes, Sign in with StarIntel branding, operator-secret bootstrap, audit trail, backup posture — every value recorded in the PR as a deliberate decision.
quasar-oidc-login.md (new) — add it to the quasar login: server-side Authorization Code + PKCE against auth.starintel.actor, callback verification, claims-to-entitlement session registration, shared-token suppression (#71), and explicit retirement of the interim password prompts. Gate removal stays with oidc-finalization.md section 3.

Docs only. Evidence: 7-prompt section-contract + no-credential-material scan pass; quasar-auth suite 36 checks 0 failures; prolog-verify check passed (observations at 3553b23).

Completes the two-slice OIDC split the operator asked for: - **oidc-zitadel-deploy.md** (updated) — deploy the OIDC service AND configure sane defaults: registration + email-verification policy, password/MFA posture, token lifetimes, Sign in with StarIntel branding, operator-secret bootstrap, audit trail, backup posture — every value recorded in the PR as a deliberate decision. - **quasar-oidc-login.md** (new) — add it to the quasar login: server-side Authorization Code + PKCE against auth.starintel.actor, callback verification, claims-to-entitlement session registration, shared-token suppression (#71), and explicit retirement of the interim password prompts. Gate removal stays with oidc-finalization.md section 3. Docs only. Evidence: 7-prompt section-contract + no-credential-material scan pass; quasar-auth suite 36 checks 0 failures; prolog-verify check passed (observations at 3553b23).

nsaspy added 1 commit

2026-09-06 23:56:50 +00:00

docs: finish the OIDC pair — sane ZITADEL defaults and the quasar login slice 3553b234fd

oidc-zitadel-deploy.md now pins the instance configuration as recorded,
deliberate defaults (registration and email-verification policy, password
and MFA posture, token lifetimes, Sign in with StarIntel branding,
operator-secret bootstrap, audit trail, backup posture). quasar-oidc-login.md
executes oidc-finalization.md section 2 as its own slice: server-side
Authorization Code + PKCE, callback verification, claims-to-entitlement
session registration, shared-token suppression, and the explicit
retirement of the interim password prompts.

nsaspy merged commit b256386b27 into main

2026-09-06 23:56:51 +00:00

nsaspy referenced this pull request from a commit

2026-09-06 23:56:51 +00:00

Merge pull request 'docs: finish the OIDC pair — sane ZITADEL defaults and the quasar login slice' (#11) from docs/oidc-pair-prompts into main