Post #2630833
2026-05-12 17:24 UTC
@ghostwriter@phpc.social Oh and... How do I know whether the OP is actually validating that domain?
So I have to check the domain-validation every time I send someone at login to that OP....
And I have to recheck the domain validation on every change to the OP config...
Replies (1)
-
@ghostwriter@phpc.social 2026-05-12 17:28
@heiglandreas@phpc.social Not quite. You do not need to re-verify the domain on every login. You need to treat domain ownership and OIDC configuration as separate security objects with different lifecycles. At login time, you only check, "does this email domain map to a previously approved OP?". If yes, then redirect there. No DNS revalidation required.