Neon Law | Deployed runtime: identity and access

Deployed runtime: identity and access

Concern	Environment variables	Behavior when absent
Browser OIDC issuer	`OAUTH_ISSUER_URL`	Browser login is not configured
Browser OIDC client	`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`	Browser login is not configured
Browser redirect	`OAUTH_REDIRECT_URI`	Browser login is not configured
Bearer JWKS	`OIDC_JWKS_URL`, `OIDC_AUDIENCE`, `OIDC_ISSUER`	Deployed JWT verification
Bearer HMAC	`OIDC_HS256_SECRET`	Local/test verifier path
Dev bypass	`OIDC_DISABLED`	Off; the dev profile and production reject `true` / `1`
Bootstrap Owner	`NAVIGATOR_BOOTSTRAP_OWNER_EMAIL`	No identity is JIT-created
Protected firm Entity	`NAVIGATOR_BOOTSTRAP_COMPANY`	`Shook Law PLLC` is protected either way
Self-signup	`NAVIGATOR_SELF_SIGNUP_ENABLED`	Off; an unknown email is refused (403)
Google token policy	`GOOGLE_OAUTH_CLIENT_IDS`, `GOOGLE_OAUTH_REQUIRED_HD`	No client/domain pin
Google token endpoint	`GOOGLE_TOKENINFO_URL`	Google default
Password door	`NAVIGATOR_IDENTITY_PLATFORM_API_KEY`	OIDC-only login
Password endpoint	`NAVIGATOR_IDENTITY_PLATFORM_ENDPOINT`	Google default
Identity Platform admin calls	`NAVIGATOR_GCP_METADATA_ENDPOINT`	GCE metadata server default

Presenter notes

Authentication and application authorization stay separate. OIDC proves identity; persons.role and Project participation decide access. OIDC_DISABLED exists for host-side diagnosis but the deployment invariant rejects it in both parsed profiles. NAVIGATOR_GCP_METADATA_ENDPOINT, GOOGLE_TOKENINFO_URL, and NAVIGATOR_IDENTITY_PLATFORM_ENDPOINT are controlled test seams; a normal deploy leaves them on their secure defaults. NAVIGATOR_BOOTSTRAP_COMPANY names a firm Entity that lawyer and admin may re-type or re-domicile but never rename or delete. It adds to rather than replaces the protected set: the canonical seed re-creates Shook Law PLLC by exact name on every boot, so that row is protected in every deployment and a white-label operator's own firm Entity is protected alongside it.

View all slides Open display