The main issue I can see with specifying a third-party URL is that our existing content security policies don't allow for it - we would need to cache/store it locally for display - which I'd prefer we did for performance and consistency reasons.

There's also the matter of size/format etc which becomes its own nuisance across different user devices.

Yeah, I don't think I'd be comfortable with a third party url here. i'd rather have kani serve the blob, which would give us a lot more control about replication and serving this reliably.

required args are surrounded by <>.

Would kanidm system oauth2 set-image <name> </path/to/local/file.svg> <imagetype> be a good interface to handle this ?
It think it'd just need to send the post to /v1/oauth2/{:rs_name}/_image.
We will need to update:

• the user applist webui to try to show the icons
• the internals to advertise the /ui/images/oauth2/{:rs_name} endpoints inside AppLink::Oauth2 objects
• preferably lazy load the images ?

lmk if I missed something.

You shouldn't have to set image type, but the CLI command matches what I'd expect.