Google OIDC provider: link-only, sub-keyed, PKCE and nonce #2
2026-11-04
Google link is two-phase; callback evaluates all linked identities
The callback records a typed pending link (short TTL, single use) and writes no linked identity; POST /v1/apps/:appSlug/links/confirm with the Heimdall access token of the initiating account attaches it. A victim who completes an attacker's link URL attaches nothing. The sign-in callback also evaluates the account's other linked identities with the start-time policy, so a Discord-origin member returning via Google keeps app_access. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Google OIDC provider: link-only, sub-keyed, PKCE and nonce
Google is a Heimdall provider behind Bifrost, with no direct upstream. Scopes openid email profile; the callback verifies the id_token (RS256 against Google's keys, iss, aud, exp, iat, nonce) and requires a verified email. The identity key is sub, never the email. PKCE verifier and nonce are derived from the state jti and Heimdall's signing key, so nothing is stored between start and callback. Google never mints an account. mode=link needs a Heimdall access token for the app and attaches to that account only; sign_in signs in an identity already linked; an unknown sub is refused, and a sub held by another account is never moved. The six existing providers still mint on first login. Admitted to the bifrost profile only. The Idunn recipe declares the Google client id and secret file. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>