Post #2493907
2026-05-12 15:42 UTC
I am reaaaaaallllly irritated by OIDC. ANd my websearch-foo is letting me down.
So when a client does the whole OIDC dance, everything is secure and safe.
But ...
How do I make sure when I want others to set up OIDC on my service that the OIDC-provider actually is trustworthy for a certain email-domain?
How do I make sure that the user doesn't just configure a fake OP for a domain that then harvests all the logins and passwords?
What did I miss?
#OIDC #oauth
Replies (2)
-
@tobiasgies@chaos.social 2026-05-12 16:18
@heiglandreas@phpc.social Let's start with the assumption that OIDC is a trust anchor for a certain email domain - that's just not the case?
-
@ghostwriter@phpc.social 2026-05-12 17:07
@heiglandreas@phpc.social You need a proof of domain control before accepting an OP for a domain. Require one of: - DNS TXT record - HTTPS well-known file - Email verification to domain admins