Skip to content

The standalone application and the getting started pages - #4

Merged
Spomky merged 1 commit into
0.1from
docs/the-application-and-getting-started
Oct 26, 2026
Merged

Spomky merged 1 commit into
0.1from
docs/the-application-and-getting-started

Conversation

@Spomky

@Spomky Spomky commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Six drafts are written: The standalone application and A Symfony relying party under getting started, plus the four pages of the application (configuration, deployment, operating, observability). Eight published pages are corrected where the code says otherwise.

Everything was written from beffroi-auth/beffroi 82d5e993, then read against the code again by a second agent. Twelve findings of that second reading are fixed.

Corrections to published pages

  • Public client loopback. A public client's loopback redirect URI matches on any port, and a custom URI scheme is refused. The example in Your first client used one.
  • PKCE waivers. PKCE can be waived for one declared confidential client (requires_pkce: false) or for every confidential client a registration policy registers, never for a public one.
  • Registration endpoint. A tenant that names no client_registration.mode has no registration endpoint.
  • First keys. The MESSAGE-SEAL key is drawn before any other: drawing a key announces it on a transport, and no message leaves unsealed.
  • Messenger default. The lanes default to doctrine://default, not to a synchronous transport.
  • The issuer is fixed. The issuer of a tenant never changes, and tenant:synchronize does not say what it did.
  • KMS client. The configuration names a key_management client, which the example now declares.
  • Migrations. doctrine:migrations:migrate needs doctrine/doctrine-migrations-bundle.
  • Headers. The headers of the bundle and of the application meet in one policy.

The migration page stays a draft, since nothing is released; its section on coming from another provider says what exists today.

make check passes on this branch alone.

…tting started pages put right

The two drafts of getting started and the four pages of the application are written from the code: the
development stack and the first start in order, the relying party on Symfony's own oidc_login and a resource
server beside it, every variable the application reads, the image, the processes and what they share, the
routine and the rare operations, and what the provider records.

The published pages read against the same code: a public client's loopback URI matches on any port and a
custom scheme is refused, PKCE is waived per confidential client or per registration policy and never for a
public one, a tenant without a registration mode has no registration endpoint, the key messages are sealed
to comes first, the lanes default to the database, the issuer of a tenant never changes, the configuration
names a client of symfony/key-management, and the headers of the bundle and of the application meet in one
policy. The migration page says what exists for coming from another provider.
@Spomky
Spomky merged commit 7c858d7 into 0.1 Oct 26, 2026
2 checks passed
@Spomky
Spomky deleted the docs/the-application-and-getting-started branch October 26, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant