mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 14:16:12 +00:00
Marc-André Bombeck
b57c517929
Setup walk (byte-exact redirect URI), client-registration essentials for Authentik / Keycloak / Authelia / Pocket-ID, the security model (identity pinned to (issuer, sub) after a one-time verified-email link; SSO sessions never satisfy step-up; native-2FA accounts still get their second-factor step; MFA policy belongs at the IdP), the OIDC_ONLY consequences incl. the iOS lockout and the break-glass runbook, and a troubleshooting table for the recurring failure shapes (issuer trailing slash, unfollowed discovery redirects, clock skew, IdP-side redirect_uri mismatch).