dsh-oidc

When deploying DeepSeek Harness inside an enterprise network, the challenge is rarely just adding a login button. dsh-oidc addresses the full security loop between identity verification and model invocation: confirming who the user is, whether they may receive a specific Provider's runtime credential, how that credential is rotated and revoked, and how a local Provider adapter reads it safely—each step kept within an auditable boundary.

The plugin composes four clearly scoped responsibilities: standard OIDC Authorization Code + PKCE public-client login (Discovery, PKCE S256, ID Token validation, refresh, and optional revocation); an enterprise Key Binding protocol that uses the OIDC Access Token to request, resolve, or rotate revocable model API keys from the institution's backend; a local OpenAI-compatible DSH Provider adapter that feeds credentials and a model catalog into the conversation runtime; and a bounded brand-customization layer with a shared Web / Desktop enterprise settings page registered through the official DSH settings.section extension point.

It is built for educational institutions or enterprise teams that already operate their own OIDC provider, Key Binding service, and model gateway: run DSH in loopback mode on a trusted single-user machine to close the loop from sign-in to model calls, while the open-source core enforces its security boundary—remote configuration is data-only and can never inject scripts, components, or custom Provider adapters.