unkinben
1dab2ecc6f
Introduce a user -> role -> [permissions] model for app access and roles, managed declaratively. - Permission groups (akP-<app>-<access>) under config/permissions/: atomic units, each names the application it grants access to. - Role groups (akR-<role>) under config/roles/: what users are assigned to; each nests permission groups via parents (akR-global-admin -> all *-admin, akR-standard-user -> all *-user). Split into a separate authentik_group resource so roles can reference permission ids without self-reference. - Policy bindings gate each application to its permission groups (and, via child->parent membership propagation, the roles that nest them). - Hierarchical `groups` scope mapping: walks user groups up through .parents so the OIDC claim includes inherited permission groups (works around goauthentik/authentik#15579). Inert until a provider requests the `groups` scope, so no behaviour change to existing apps until they opt in. Validated with `tofu validate`.
7 lines
165 B
YAML
7 lines
165 B
YAML
# Role: standard (non-admin) access across all onboarded apps.
|
|
name: akR-standard-user
|
|
permissions:
|
|
- ak-p-grafana-user
|
|
- ak-p-argocd-user
|
|
- ak-p-rancher-user
|