unkinben
80fa1b2844
Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical `ak_groups` claim and grant Rancher global roles to the akP-rancher permission groups. Members of akR-global-admin/akR-standard-user inherit these. - keycloakoidc: scopes += ak_groups; groups_field = ak_groups - global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user (group principal keycloakoidc_group://<name>)
32 lines
1.2 KiB
Terraform
32 lines
1.2 KiB
Terraform
variable "keycloakoidc" {
|
|
description = "Rancher Keycloak(OIDC) auth provider config, or null to leave unmanaged."
|
|
type = object({
|
|
rancher_url = string # Rancher redirect URL, must end with /verify-auth
|
|
client_id = string
|
|
issuer = string # OIDC issuer (Authentik application URL)
|
|
auth_endpoint = string # OIDC authorization endpoint
|
|
scopes = optional(string, "openid profile email")
|
|
# OIDC claim to read group names from (default Rancher uses "groups").
|
|
groups_field = optional(string, "groups")
|
|
access_mode = optional(string, "unrestricted")
|
|
enabled = optional(bool, true)
|
|
# client_secret is never committed. Point at a Vault kv-v2 secret whose
|
|
# `client_secret` key holds the value (seeded out of band); TF reads it.
|
|
client_secret_vault = optional(object({
|
|
mount = string
|
|
path = string
|
|
}), null)
|
|
})
|
|
default = null
|
|
}
|
|
|
|
# Global role bindings mapping an Authentik group (permission group) to a Rancher
|
|
# global role. The group name is the map key; the OIDC group principal id is
|
|
# derived as keycloakoidc_group://<name>.
|
|
variable "global_role_bindings" {
|
|
type = map(object({
|
|
global_role_id = string # e.g. "admin", "user"
|
|
}))
|
|
default = {}
|
|
}
|