Post #2630834
2026-05-12 17:28 UTC
@heiglandreas@phpc.social Not quite.
You do not need to re-verify the domain on every login.
You need to treat domain ownership and OIDC configuration as separate security objects with different lifecycles.
At login time, you only check, "does this email domain map to a previously approved OP?".
If yes, then redirect there.
No DNS revalidation required.
Replies (2)
-
@heiglandreas@phpc.social 2026-05-12 17:31
@ghostwriter@phpc.social Ah no. Sorry that might have been misunderstood. I need to verify the domain on every change to the domains OP-config. But I do need to verify whether the domain was verified (from a cached info) whenever I send someone over - to make sure that I am not sending someone to an unverified OP
-
@ghostwriter@phpc.social 2026-05-12 17:31
@heiglandreas@phpc.social Only during initial onboarding or when sensitive configuration changes If ANY of these change: issuer discovery URL JWKS URI redirect behavior routing rules then you should require re-approval.