ietf-tools / ietf-tools/dev-planning-dispatch
Allow OIDC login at Red
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Red authenticates users as an OIDC public client against Authentik (account.ietf.org)
using Authorization Code + PKCE, entirely client-side (no BFF, no server-side session,
tokens held in the browser). This preserves Red's cacheable-anonymous-origin architecture:
auth is a client-side enhancement layered on the cached view, using a bearer token — no
auth cookie, so no CDN cache contamination.
IdP decision resolved in #97 (Authentik). Authentik/datatracker infra is #136 (other team) —
a hard dependency for end-to-end testing, out of Red scope.
Phase 0 Definition of Done (MVP): a user can log in and log out, and Red knows who they are.
No user data is loaded/saved yet (Pink does not exist in Phase 0).
Red builds no signup/password/account-management UI — those live in Authentik; Red only
links out and (optionally) shows a profile image.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no implementation files, tests, or entry points. Start with the Phase 0 definition of done and the client-side OIDC Authorization Code + PKCE constraints; verify that Red can log in, log out, and identify the user without loading user data, while treating Authentik/datatracker infrastructure in #136 as out of scope.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, frontend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100