2026-05-12 17:28 UTC
@heiglandreas@phpc.social Not quite.
You do not need to re-verify the domain on every login.
You need to treat domain ownership and OIDC configuration as separate security objects with different lifecycles.
At login time, you only check, "does this email domain map to a previously approved OP?".
If yes, then redirect there.
No DNS revalidation required.
Replies (1)
-
@ghostwriter@phpc.social 2026-05-12 17:31
@heiglandreas@phpc.social Only during initial onboarding or when sensitive configuration changes If ANY of these change: issuer discovery URL JWKS URI redirect behavior routing rules then you should require re-approval.