════════════════════════════════════════════════════════════════════
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:42:17 +0200
════════════════════════════════════════════════════════════════════
  MISSING-DEP dig
  MISSING-DEP host
  ── topology / DNS / reverse-DNS / HTTP identity
  %-28s %s DNS[videos.erg.be]: 194.78.61.186
  %-28s %s rDNS[194.78.61.186]: none
  %-28s %s DNS[mail.erg.school]: 79.99.201.114
  %-28s %s rDNS[79.99.201.114]: none
  %-28s %s DNS[portail.erg.school]: 79.99.201.119
  %-28s %s rDNS[79.99.201.119]: none
  ── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
  %-28s %s HTTP: 200
  %-28s %s issuer: https://portail.erg.school/
  %-28s %s grant_types_supported: authorization_code,refresh_token
  %-28s %s response_types_supported: code
  %-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
  %-28s %s token_endpoint: https://portail.erg.school/oauth2/token
  FINDING grant.password             → ABSENT
  FINDING grant.client_credentials   → ABSENT
  FINDING grant.authorization_code   → PRESENT
  CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
  ── PeerTube OAuth (https://videos.erg.be)
  %-28s %s config HTTP: 200
  %-28s %s local client_id: <REDACTED>
  %-28s %s local client present: yes
  %-28s %s password-grant ok: 0
  %-28s %s password-grant code: 
  ── SMTP AUTH mechanisms (mail.erg.school:587)
  %-28s %s AUTH mechanisms:  PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
  FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
  FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
  ── proxy → backend identity-header propagation
  %-28s %s echo header [X-Powered-By]: PeerTube
  %-28s %s echo header [Server]: nginx
  %-28s %s effective-url: https://videos.erg.be/

════════════════════════════════════════════════════════════════════
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
════════════════════════════════════════════════════════════════════

════════════════════════════════════════════════════════════════════
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:46:25 +0200
════════════════════════════════════════════════════════════════════
  MISSING-DEP dig
  MISSING-DEP host
  ── topology / DNS / reverse-DNS / HTTP identity
  %-28s %s DNS[videos.erg.be]: 194.78.61.186
  %-28s %s rDNS[194.78.61.186]: none
  %-28s %s DNS[mail.erg.school]: 79.99.201.114
  %-28s %s rDNS[79.99.201.114]: none
  %-28s %s DNS[portail.erg.school]: 79.99.201.119
  %-28s %s rDNS[79.99.201.119]: none
  ── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
  %-28s %s HTTP: 200
  %-28s %s issuer: https://portail.erg.school/
  %-28s %s grant_types_supported: authorization_code,refresh_token
  %-28s %s response_types_supported: code
  %-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
  %-28s %s token_endpoint: https://portail.erg.school/oauth2/token
  FINDING grant.password             → ABSENT
  FINDING grant.client_credentials   → ABSENT
  FINDING grant.authorization_code   → PRESENT
  CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
  ── PeerTube OAuth (https://videos.erg.be)
  %-28s %s config HTTP: 200
  %-28s %s local client_id: <REDACTED>
  %-28s %s local client present: yes
  %-28s %s password-grant ok: 0
  %-28s %s password-grant code: 
  ── SMTP AUTH mechanisms (mail.erg.school:587)
  %-28s %s AUTH mechanisms:  PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
  FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
  FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
  ── proxy → backend identity-header propagation
  %-28s %s response-header scope: response side only — cannot reveal inbound identity
  %-28s %s response [X-Powered-By]: PeerTube
  %-28s %s response [Server]: nginx
  ── request-side identity header probe (echo endpoint)
  %-28s %s echo endpoint: SKIPPED — pass --echo <url> (point it at echo-headers.php behind the same vhost)
  HINT: to see headers LemonLDAP injects, host scripts/echo-headers.php behind
        the SAME LemonLDAP vhost as PeerTube and re-run with --echo <that-url>.
        A public echo service only shows headers YOUR client sent, not the
        post-auth headers the SSO proxy adds.
  %-28s %s effective-url: https://videos.erg.be/

════════════════════════════════════════════════════════════════════
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
════════════════════════════════════════════════════════════════════