

3·
4 days agoThis would require configuration with a whitelist of which OIDC IdPs to trust. Otherwise anybody could self-authorise a OIDC token (using their own IdP) and use that to log in.
This would require configuration with a whitelist of which OIDC IdPs to trust. Otherwise anybody could self-authorise a OIDC token (using their own IdP) and use that to log in.
I agree with you, a simple minimal url-shortener does not need 2FA.