unkinben
80fa1b2844
Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical `ak_groups` claim and grant Rancher global roles to the akP-rancher permission groups. Members of akR-global-admin/akR-standard-user inherit these. - keycloakoidc: scopes += ak_groups; groups_field = ak_groups - global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user (group principal keycloakoidc_group://<name>)
18 lines
857 B
YAML
18 lines
857 B
YAML
# Rancher Keycloak(OIDC) auth provider backed by Authentik.
|
|
# client_secret is read from Vault (the same secret Authentik sets on its
|
|
# provider), not committed. access_mode "unrestricted" avoids admin lockout:
|
|
# any Authentik user can authenticate; Rancher roles are assigned separately.
|
|
rancher_url: https://rancher.k8s.syd1.au.unkin.net/verify-auth
|
|
client_id: rancher
|
|
issuer: https://identity.unkin.net/application/o/rancher/
|
|
auth_endpoint: https://identity.unkin.net/application/o/authorize/
|
|
# ak_groups = hierarchical group claim from terraform-authentik (permission
|
|
# groups inherited via role groups). groups_field points Rancher at that claim.
|
|
scopes: openid profile email ak_groups
|
|
groups_field: ak_groups
|
|
access_mode: unrestricted
|
|
enabled: true
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/cattle-system/default/oauth-credentials
|