Post #2630830
2026-05-12 17:07 UTC
@heiglandreas@phpc.social You need a proof of domain control before accepting an OP for a domain.
Require one of:
- DNS TXT record
- HTTPS well-known file
- Email verification to domain admins
Replies (2)
-
@ghostwriter@phpc.social 2026-05-12 17:20
@heiglandreas@phpc.social The mental model for OIDC is: "Who authenticated the user?" You still must answer: "Why do I trust this OP for this organization/domain?" This is an application trust/onboarding problem, not an authentication protocol problem.
-
@heiglandreas@phpc.social 2026-05-12 17:21
@ghostwriter@phpc.social Yeah. That's kind a what I do already. But it's interesting that that info seems to be nowhere found.... Or let me rephrase that: All infos I found so far were starting *after* that verification. And that really becomes a mess when I think of entra allowing guest-accounts with totally not under the control of the domain email-addresses 🤯 Ah well....