From 2c9e90ac2b6e59096e70635af8314b949383c6d4 Mon Sep 17 00:00:00 2001 From: CTO Date: Sat, 5 Sep 2026 09:57:39 +0000 Subject: [PATCH] docs(outline): note PKCE must be disabled on the Pocket ID client Outline's OIDC plugin does not send `code_challenge`, so the Pocket ID client must be created with `pkceEnabled: false` (default is `true`). Login fails with `?notice=auth-error` and Pocket ID rejects `/authorize` when PKCE is enforced. Co-Authored-By: Paperclip --- apps/outline/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/outline/README.md b/apps/outline/README.md index 1758288..a183944 100644 --- a/apps/outline/README.md +++ b/apps/outline/README.md @@ -28,7 +28,7 @@ Self-hosted knowledge base — [Outline](https://www.getoutline.com/). ## Deployment references - Argo Application: `apps/app-outline.yaml` -- Pocket ID OIDC client id: `b4a84bbd-fae4-445e-868e-5c1197e5d155` +- Pocket ID OIDC client id: `b4a84bbd-fae4-445e-868e-5c1197e5d155` (PKCE **disabled** — Outline's OIDC plugin does not send `code_challenge`; group restriction on, allowed groups: `outline_admins`, `outline_members`) - Pocket ID groups: `outline_admins` (`2b41fc67-eb7b-43d8-8954-85426214f1a8`), `outline_members` (`aa6df56f-b868-4de1-adf7-8696e990aa53`) - DNS: `outline.basicstack.de` A → `138.199.128.63` (cluster ingress) - S3 endpoint: `https://hel1.your-objectstorage.com` bucket `outline-basicstack` (CORS whitelisted to `https://outline.basicstack.de`)