unkinben
9c5937776e
Ceph dashboard SSO is SAML 2.0 (no native OIDC), so onboard it via an Authentik SAML provider + application. Also resolve SAML authorization/invalidation flows by slug and the signing keypair by name (mirrors the oauth2 handling), since the SAML path had not been exercised before. - config/providers_saml/ceph.yaml: SP entity id/ACS derived from the dashboard base URL (audience .../auth/saml2/metadata, acs .../auth/saml2, HTTP-POST), signed with the built-in self-signed keypair. Ceph side (separate, Puppet): ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url> Validated with `terragrunt plan`: 2 to add (provider + application).
16 lines
843 B
YAML
16 lines
843 B
YAML
# SAML provider + application for the Ceph dashboard (dashboard.ceph.unkin.net).
|
|
# Ceph dashboard SSO is SAML 2.0 (no native OIDC). The SP entity id and ACS URL
|
|
# are derived by Ceph from its base URL:
|
|
# entity id (audience): <base>/auth/saml2/metadata
|
|
# ACS url (HTTP-POST): <base>/auth/saml2
|
|
# Configure the Ceph side (Puppet/mgr) with:
|
|
# ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>
|
|
name: Ceph Dashboard
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
acs_url: https://dashboard.ceph.unkin.net/auth/saml2
|
|
audience: https://dashboard.ceph.unkin.net/auth/saml2/metadata
|
|
sp_binding: post
|
|
# Authentik's built-in self-signed keypair, resolved by name; signs assertions.
|
|
signing_kp: authentik Self-signed Certificate
|