# Default OIDC login role (the mount's default_role), used by both the web UI
# and `bao login -method=oidc`.
#
# The role grants no policies of its own: authorization comes from the external
# identity groups under config/auth_oidc_group, matched on the ak_groups claim.
# ak_groups is Authentik's hierarchy-expanding claim (plain `groups` only carries
# direct memberships), so nested akP-* permission groups resolve.
#
# allowed_redirect_uris must match the provider's strict URIs exactly.
---
user_claim: "email"
groups_claim: "ak_groups"
oidc_scopes:
  - openid
  - profile
  - email
  - ak_groups
bound_audiences:
  - vault
allowed_redirect_uris:
  - "http://localhost:8250/oidc/callback"
  - "https://vault.k8s.syd1.au.unkin.net/ui/vault/auth/oidc/oidc/callback"
  - "https://vault.service.consul:8200/ui/vault/auth/oidc/oidc/callback"
token_ttl: 86400
token_max_ttl: 604800