benvin
94e8ac1b2a
ci/woodpecker/push/apply Pipeline was successful
- 1 day / 7 days for oidc logins --------- Co-authored-by: unkin-agent <unkin-agent@unkin.net> Reviewed-on: #150
26 lines
882 B
YAML
26 lines
882 B
YAML
# Default OIDC login role (the mount's default_role), used by both the web UI
|
|
# and `bao login -method=oidc`.
|
|
#
|
|
# The role grants no policies of its own: authorization comes from the external
|
|
# identity groups under config/auth_oidc_group, matched on the ak_groups claim.
|
|
# ak_groups is Authentik's hierarchy-expanding claim (plain `groups` only carries
|
|
# direct memberships), so nested akP-* permission groups resolve.
|
|
#
|
|
# allowed_redirect_uris must match the provider's strict URIs exactly.
|
|
---
|
|
user_claim: "email"
|
|
groups_claim: "ak_groups"
|
|
oidc_scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- ak_groups
|
|
bound_audiences:
|
|
- vault
|
|
allowed_redirect_uris:
|
|
- "http://localhost:8250/oidc/callback"
|
|
- "https://vault.k8s.syd1.au.unkin.net/ui/vault/auth/oidc/oidc/callback"
|
|
- "https://vault.service.consul:8200/ui/vault/auth/oidc/oidc/callback"
|
|
token_ttl: 86400
|
|
token_max_ttl: 604800
|