Firstyear

Accidentally close, sorry.

I think per the spec we must enforce the name is set.

The spec *also* used to let you strip and disregard UV in a lot of cases until the spec was updated to "strongly advise" people to check that. It wouldn't...

Had a quick read - looks like an "improved" oauth2 / oidc framework, but would sit in parallel. I'm not against it at all, but as mentioned I'd like to...

Yeah, I think there is a lot in there to take it, it's written by an oauth2 spec contributor so they seem to be knowledgable about the weaknesses of oauth2...

A possible option is to have your call to `systemd-ask-password` call --credential so that if a systemd credential exists it can be used instead.

https://github.com/OpenVPN/openvpn/pull/630

We actually have profiles for this https://kanidm.github.io/kanidm/stable/client_tools.html#multiple-instances This way you can just export an env variable at the start of a session to define which instance you want to use,...

I'm trying to think about how this might affect the user experience. The thing is that per instance we aren't just storing the url but the jwk that signs the...

This is a really thoughtful and well written reply, thank you! I think renaming "instances" to "scopes" might be a good option here. It does make a lot of sense....