Neon Law | Workshops | Deploy The Navigator | Step

Deployed runtime: identity and access

Concern	Environment variables	Behavior when absent
Browser OIDC issuer	`OAUTH_ISSUER_URL`	Browser login is not configured
Browser OIDC client	`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`	Browser login is not configured
Browser redirect	`OAUTH_REDIRECT_URI`	Browser login is not configured
Microsoft door	`OAUTH_MICROSOFT_CLIENT_ID`, `OAUTH_MICROSOFT_CLIENT_SECRET`	Off; one provider, one button
Microsoft tenants	`OAUTH_MICROSOFT_ALLOWED_TENANTS`	Boot fails when the client id is set
Microsoft authority	`OAUTH_MICROSOFT_ISSUER_URL`	The `organizations` authority: work or school, any tenant
Apple door	`OAUTH_APPLE_CLIENT_ID` + three secret values	Off without client ID; boot fails if sibling missing
Bearer JWKS	`OIDC_JWKS_URL`, `OIDC_AUDIENCE`, `OIDC_ISSUER`	Deployed JWT verification
Bearer HMAC	`OIDC_HS256_SECRET`	Local/test verifier path
Dev bypass	`OIDC_DISABLED`	Off; the dev profile and production reject `true` / `1`

Presenter notes

Authentication and application authorization stay separate. OIDC proves identity; persons.role and Project participation decide access. OIDC_DISABLED exists for host-side diagnosis but the deployment invariant rejects it in both parsed profiles. NAVIGATOR_GCP_METADATA_ENDPOINT, GOOGLE_TOKENINFO_URL, and NAVIGATOR_IDENTITY_PLATFORM_ENDPOINT are controlled test seams; a normal deploy leaves them on their secure defaults. NAVIGATOR_BOOTSTRAP_COMPANY names a firm Entity that lawyer and admin may re-type or re-domicile but never rename or delete. It adds to rather than replaces the protected set: the canonical seed re-creates Shook Law PLLC by exact name on every boot, so that row is protected in every deployment and a white-label operator's own firm Entity is protected alongside it.

View all slides Open display