unkinben
9c5937776e
Ceph dashboard SSO is SAML 2.0 (no native OIDC), so onboard it via an Authentik SAML provider + application. Also resolve SAML authorization/invalidation flows by slug and the signing keypair by name (mirrors the oauth2 handling), since the SAML path had not been exercised before. - config/providers_saml/ceph.yaml: SP entity id/ACS derived from the dashboard base URL (audience .../auth/saml2/metadata, acs .../auth/saml2, HTTP-POST), signed with the built-in self-signed keypair. Ceph side (separate, Puppet): ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url> Validated with `terragrunt plan`: 2 to add (provider + application).
terraform-authentik
Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
Managed Resources
- Groups — roles and group hierarchy (users are invited manually)
- SAML providers — SAML application integrations
- OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
- LDAP providers — LDAP provider and outpost configuration
- Applications — application definitions linked to providers
Configuration
Resources are defined as YAML files under config/:
config/
├── groups/ # Group definitions
├── providers_saml/ # SAML provider definitions
├── providers_oauth2/ # OAuth2/OIDC provider definitions
└── providers_ldap/ # LDAP provider definitions
Usage
make plan # init + plan
make apply # init + plan + apply
make format # format all .tf and .hcl files
Authentication
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.