HUCIAL SSO 1.1.0
================

Purpose
-------
Single sign-on between:
- identity issuer: https://hucial.com (technical phpBB root: /portal)
- client: https://phpbb.hucial.com

The same extension is installed on both phpBB 3.3.17 instances.
No password is copied between databases.

Security model
--------------
- Ed25519 signed, short-lived assertions.
- Assertions are POSTed to the client callback (not put in the URL).
- One-time state stored on PHPBB Lab and bound to its phpBB session.
- The state is consumed at callback, preventing replay.
- Audience and issuer are checked.
- Native local phpBB login remains reachable directly for emergency/admin access.

Default key paths
-----------------
/var/www/hucial/storage/sso/private.key
/var/www/hucial/storage/sso/public.key

First administrator link
------------------------
An already existing PHPBB Lab account is linked once with "Lier mon compte HUCIAL".
After that, normal PHPBB Lab sign-in goes through HUCIAL SSO.

Single registration source since 1.0.1
--------------------------------------
- HUCIAL is the only public registration source.
- PHPBB Lab public registration redirects to HUCIAL.
- Existing HUCIAL members are provisioned automatically on their first Lab SSO login.
- Existing standalone Lab accounts can be linked once.

Version 1.1.0 - shared HUCIAL community statistics
--------------------------------------------------
HUCIAL and PHPBB Lab now share the member-related public statistics displayed by
phpBB without copying the complete users table between databases.

Authoritative membership statistics:
- HUCIAL remains the source of truth for total registered members.
- The newest HUCIAL member is displayed on PHPBB Lab as well.
- PHPBB Lab local provisioning count does not replace the HUCIAL member total.

Shared online members:
- Both instances write recent activity to one state file outside the public root.
- Activity is keyed by the issuer HUCIAL user id, so a member active on both
  instances is counted only once.
- Only SSO-linked Lab accounts enter the shared HUCIAL online count.
- Hidden-online preference is retained for the displayed member list.
- The shared online record is stored in the same state.
- Default online window: 300 seconds (5 minutes).

Shared state path:
/var/www/hucial/storage/sso/stats/community.json

The parent stats directory must be writable by the web server. Recommended:
owner/group root:www-data, directory mode 770. The JSON state file is created
by the extension and is kept outside /var/www/hucial/public.

What is intentionally NOT synchronized
--------------------------------------
- passwords;
- full phpbb_users tables;
- forum posts/topics statistics;
- PHPBB Lab member-list pagination or local ACP user inventory.

Those remain local to their respective phpBB instance. Only the public
member/community counters are shared.
