unkinben
1dab2ecc6f
Introduce a user -> role -> [permissions] model for app access and roles, managed declaratively. - Permission groups (akP-<app>-<access>) under config/permissions/: atomic units, each names the application it grants access to. - Role groups (akR-<role>) under config/roles/: what users are assigned to; each nests permission groups via parents (akR-global-admin -> all *-admin, akR-standard-user -> all *-user). Split into a separate authentik_group resource so roles can reference permission ids without self-reference. - Policy bindings gate each application to its permission groups (and, via child->parent membership propagation, the roles that nest them). - Hierarchical `groups` scope mapping: walks user groups up through .parents so the OIDC claim includes inherited permission groups (works around goauthentik/authentik#15579). Inert until a provider requests the `groups` scope, so no behaviour change to existing apps until they opt in. Validated with `tofu validate`.
27 lines
581 B
HCL
27 lines
581 B
HCL
include "root" {
|
|
path = find_in_parent_folders("root.hcl")
|
|
expose = true
|
|
}
|
|
|
|
include "config" {
|
|
path = "${get_repo_root()}/config/config.hcl"
|
|
expose = true
|
|
}
|
|
|
|
locals {
|
|
config = include.config.locals.config
|
|
}
|
|
|
|
terraform {
|
|
source = "../../modules/authentik"
|
|
}
|
|
|
|
inputs = {
|
|
groups = local.config.groups
|
|
permission_groups = local.config.permission_groups
|
|
role_groups = local.config.role_groups
|
|
providers_saml = local.config.providers_saml
|
|
providers_oauth2 = local.config.providers_oauth2
|
|
providers_ldap = local.config.providers_ldap
|
|
}
|