# SAML provider + application for the Ceph dashboard (dashboard.ceph.unkin.net).
# Ceph dashboard SSO is SAML 2.0 (no native OIDC). The SP entity id and ACS URL
# are derived by Ceph from its base URL:
#   entity id (audience): <base>/auth/saml2/metadata
#   ACS url (HTTP-POST):  <base>/auth/saml2
# Configure the Ceph side (Puppet/mgr) with:
#   ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>
name: Ceph Dashboard
authorization_flow: default-provider-authorization-implicit-consent
invalidation_flow: default-provider-invalidation-flow
acs_url: https://dashboard.ceph.unkin.net/auth/saml2
audience: https://dashboard.ceph.unkin.net/auth/saml2/metadata
sp_binding: post
# Authentik's built-in self-signed keypair, resolved by name; signs assertions.
signing_kp: authentik Self-signed Certificate