Phil Skentelbery
68669b9a6a
Add minimal, production-ready static HTML identity page as reference implementation for IndieAuth authentication. Includes: - Complete identity-page.html with h-card and IndieAuth endpoints - Architectural documentation and rationale - ADR-010: Static Identity Page decision record - Customization guide for users The example is zero-dependency, copy-paste ready, and guaranteed to work with IndieLogin.com and StarPunk. Pre-configured for thesatelliteoflove.com as working example. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
250 lines
8.2 KiB
Markdown
250 lines
8.2 KiB
Markdown
# Identity Domain Validation Report
|
|
**Domain**: https://thesatelliteoflove.com
|
|
**Date**: 2025-11-19
|
|
**Validator**: StarPunk Architect Agent
|
|
**Purpose**: Validate IndieAuth configuration for StarPunk authentication
|
|
|
|
## Executive Summary
|
|
|
|
**STATUS**: PARTIALLY READY - Configuration present but has critical issues
|
|
|
|
The identity domain `https://thesatelliteoflove.com` has the core IndieAuth metadata in place, but contains several configuration errors that will prevent successful authentication. The domain requires fixes before it can be used with StarPunk.
|
|
|
|
## IndieAuth Configuration Analysis
|
|
|
|
### 1. Authorization Endpoint ✓ PRESENT (with issues)
|
|
```html
|
|
<link rel="authorization_endpoint" href="https://indieauth.com/auth">
|
|
```
|
|
- **Status**: Configured
|
|
- **Endpoint**: IndieAuth.com (established IndieAuth service)
|
|
- **Issue**: HEAD request returned HTTP 400, suggesting the endpoint may have issues or requires specific parameters
|
|
- **Impact**: May cause authentication to fail
|
|
|
|
### 2. Token Endpoint ✓ PRESENT
|
|
```html
|
|
<link rel="token_endpoint" href="https://tokens.indieauth.com/token">
|
|
```
|
|
- **Status**: Configured
|
|
- **Endpoint**: tokens.indieauth.com (official token service)
|
|
- **Validation**: Returns HTTP 200, endpoint is accessible
|
|
- **Impact**: Token generation should work correctly
|
|
|
|
### 3. Micropub Endpoint ⚠️ DUPLICATE CONFIGURATION
|
|
```html
|
|
<link rel="micropub" href="https://thesatelliteoflove.com//micropub">
|
|
<link rel="micropub" href="" />
|
|
```
|
|
- **Issue**: Two micropub declarations, one empty
|
|
- **Impact**: May confuse clients; the empty one should be removed
|
|
- **Note**: The first one points to the domain but has double slash (//)
|
|
|
|
## Identity Information (h-card)
|
|
|
|
### Body-level h-card ✓ PRESENT (incomplete)
|
|
```html
|
|
<body class="h-card">
|
|
```
|
|
- **Status**: Configured at body level
|
|
- **Issue**: The entire page is marked as an h-card, which is technically valid but not best practice
|
|
|
|
### Identity Properties Found:
|
|
|
|
1. **Name (p-name)**: ✓ PRESENT
|
|
```html
|
|
<a class="u-url p-name" href="/">Home</a>
|
|
<span class="p-author h-card">Phil Skents</span>
|
|
```
|
|
- Conflicting names: "Home" vs "Phil Skents"
|
|
- Best practice: Should have a single, clear p-name property
|
|
|
|
2. **URL (u-url)**: ✓ PRESENT
|
|
```html
|
|
<a class="u-url p-name" href="/">Home</a>
|
|
```
|
|
- Links to homepage
|
|
- Should be full URL (https://thesatelliteoflove.com) for clarity
|
|
|
|
3. **Photo (u-photo)**: ✗ MISSING
|
|
- No photo property found
|
|
- Recommended for complete identity representation
|
|
|
|
4. **Email (u-email)**: Potentially present
|
|
```html
|
|
<link href="mailto:phil@thesatelliteoflove.com" rel="me">
|
|
```
|
|
- Present as rel="me" link, not as u-email property
|
|
|
|
## Social Proof (rel="me" links)
|
|
|
|
### Links Found:
|
|
1. ✗ **Empty rel="me"**: `<link rel="me" href="" />`
|
|
2. ✓ **Email**: `<link href="mailto:phil@thesatelliteoflove.com" rel="me">`
|
|
|
|
**Issues**:
|
|
- One empty rel="me" link should be removed
|
|
- No links to social media profiles (GitHub, Mastodon, etc.)
|
|
- Missing bidirectional verification for rel="me" web sign-in
|
|
|
|
## Security Assessment
|
|
|
|
### HTTPS Configuration: ✓ PASS
|
|
- Domain properly serves over HTTPS
|
|
- No mixed content detected in initial inspection
|
|
|
|
### Endpoint Accessibility:
|
|
- Token endpoint: ✓ Accessible (HTTP 200)
|
|
- Authorization endpoint: ⚠️ Returns HTTP 400 (may need investigation)
|
|
|
|
### Domain Redirects:
|
|
- No redirects detected
|
|
- Clean HTTPS delivery
|
|
|
|
## IndieWeb Microformats
|
|
|
|
### Found:
|
|
- `h-card`: Present (body-level)
|
|
- `h-feed`: Present on homepage
|
|
- `h-entry`: Present for content items
|
|
- `p-name`, `u-url`, `dt-published`: Properly used in feed items
|
|
- `p-author`: Present in footer
|
|
|
|
**Assessment**: Good microformats2 markup for content, but identity h-card needs refinement.
|
|
|
|
## Critical Issues Requiring Fixes
|
|
|
|
### Priority 1: Must Fix Before Production
|
|
1. **Remove empty links**:
|
|
- Empty `rel="me"` link
|
|
- Empty `rel="micropub"` link
|
|
- Empty `rel="webmention"` link
|
|
- Empty `rel="pingback"` link
|
|
|
|
2. **Fix micropub double-slash**:
|
|
- Change `https://thesatelliteoflove.com//micropub`
|
|
- To: `https://starpunk.thesatelliteoflove.com/micropub`
|
|
- (This should point to StarPunk, not the identity domain)
|
|
|
|
3. **Clarify h-card identity**:
|
|
- Create a dedicated h-card element (not body-level)
|
|
- Use consistent p-name ("Phil Skents", not "Home")
|
|
- Add u-url with full domain URL
|
|
- Consider adding u-photo
|
|
|
|
### Priority 2: Should Fix for Best Practice
|
|
1. **Add social proof**:
|
|
- Add rel="me" links to social profiles
|
|
- Ensure bidirectional linking for web sign-in
|
|
|
|
2. **Simplify h-card structure**:
|
|
- Move h-card from body to specific element (header or aside)
|
|
- Reduce confusion with multiple p-name properties
|
|
|
|
3. **Investigation needed**:
|
|
- Determine why https://indieauth.com/auth returns HTTP 400
|
|
- May need to test full authentication flow
|
|
|
|
## Expected Authentication Flow
|
|
|
|
### Current State:
|
|
1. User enters `https://thesatelliteoflove.com` as identity URL
|
|
2. StarPunk fetches the page and finds:
|
|
- Authorization endpoint: `https://indieauth.com/auth`
|
|
- Token endpoint: `https://tokens.indieauth.com/token`
|
|
3. StarPunk redirects to IndieAuth.com with:
|
|
- client_id: `https://starpunk.thesatelliteoflove.com/`
|
|
- redirect_uri: `https://starpunk.thesatelliteoflove.com/auth/callback`
|
|
- state: (random value)
|
|
4. IndieAuth.com verifies the identity domain
|
|
5. User approves the authorization
|
|
6. IndieAuth.com redirects back with auth code
|
|
7. StarPunk exchanges code for token at tokens.indieauth.com
|
|
8. User is authenticated
|
|
|
|
### Potential Issues:
|
|
- Empty rel="me" links may confuse IndieAuth.com
|
|
- HTTP 400 from authorization endpoint needs investigation
|
|
- Micropub endpoint configuration may cause client confusion
|
|
|
|
## Recommendations
|
|
|
|
### Immediate Actions:
|
|
1. **Clean up the HTML head**:
|
|
```html
|
|
<!-- Remove these: -->
|
|
<link rel="me" href="" />
|
|
<link rel="webmention" href="" />
|
|
<link rel="pingback" href="" />
|
|
<link rel="micropub" href="" />
|
|
|
|
<!-- Fix this: -->
|
|
<link rel="micropub" href="https://starpunk.thesatelliteoflove.com/micropub">
|
|
```
|
|
|
|
2. **Improve h-card**:
|
|
```html
|
|
<header class="h-card">
|
|
<a class="u-url u-uid" href="https://thesatelliteoflove.com">
|
|
<span class="p-name">Phil Skents</span>
|
|
</a>
|
|
<a class="u-email" href="mailto:phil@thesatelliteoflove.com">Email</a>
|
|
</header>
|
|
```
|
|
|
|
3. **Add social verification**:
|
|
```html
|
|
<link rel="me" href="https://github.com/yourprofile">
|
|
<link rel="me" href="https://mastodon.social/@yourhandle">
|
|
```
|
|
|
|
### Testing Actions:
|
|
1. Test full IndieAuth flow with IndieLogin.com
|
|
2. Verify authorization endpoint functionality
|
|
3. Test with StarPunk once fixes are applied
|
|
4. Validate h-card parsing with microformats validator
|
|
|
|
## Architectural Compliance
|
|
|
|
### IndieWeb Standards: ⚠️ PARTIAL
|
|
- Has required IndieAuth endpoints
|
|
- Has microformats markup
|
|
- Missing complete identity information
|
|
- Has configuration errors
|
|
|
|
### Security Standards: ✓ PASS
|
|
- HTTPS properly configured
|
|
- Using established IndieAuth services
|
|
- No obvious security issues
|
|
|
|
### Best Practices: ⚠️ NEEDS IMPROVEMENT
|
|
- Multiple empty link elements (code smell)
|
|
- Duplicate micropub declarations
|
|
- Inconsistent identity markup
|
|
- Missing social proof
|
|
|
|
## Conclusion
|
|
|
|
**Can authentication work right now?** POSSIBLY, but with high risk of failure.
|
|
|
|
**Should it be used in production?** NO, not until critical issues are fixed.
|
|
|
|
**Estimated time to fix**: 15-30 minutes of HTML editing.
|
|
|
|
The domain has the foundational IndieAuth configuration in place, which is excellent. However, the presence of empty link elements and duplicate declarations suggests the site may have been generated from a template with placeholder values that weren't fully configured.
|
|
|
|
Once the empty links are removed, the micropub endpoint is corrected to point to StarPunk, and the h-card is refined, this domain will be fully ready for IndieAuth authentication.
|
|
|
|
## Next Steps
|
|
|
|
1. Fix the identity domain HTML (see Immediate Actions above)
|
|
2. Test authentication flow with IndieLogin.com directly
|
|
3. Verify StarPunk can discover and use the endpoints
|
|
4. Document successful authentication in test report
|
|
5. Consider creating a validation script for identity domain setup
|
|
|
|
---
|
|
|
|
**Document Status**: Complete
|
|
**Last Updated**: 2025-11-19
|
|
**Maintained By**: StarPunk Architect Agent
|