unkin-agent
b225ef6344
Human access to OpenBao is LDAP-only today, so operators carry a second set of credentials outside Authentik and group membership is maintained twice. This makes Authentik SSO the offered default on the UI login page and gives `bao login -method=oidc` a working CLI path, while approle and kubernetes (CI and agents) plus the break-glass root path are untouched. Add three modules mirroring the auth_ldap_* structure: auth_oidc_backend mounts a vault_jwt_auth_backend of type oidc, auth_oidc_role creates the default login role, and auth_oidc_group creates an external vault_identity_group plus its group alias so IdP groups map onto policies. Mount the backend at the literal path "oidc". The Authentik provider registers strict redirect URIs containing /ui/vault/auth/oidc/oidc/callback, so the path is load-bearing and must not be renamed. Read client_id and client_secret from kv/service/authentik/oidc-vault, which terraform-authentik generates and writes; nothing is seeded by hand. Match groups on the ak_groups claim rather than groups, because Authentik's default profile mapping only emits direct memberships and the estate nests akP-* permission groups under akR-* roles. Bind akP-vault-admin to global-root, the same policy the LDAP vault_admin group already carries. Only akP-* permission groups are named in config or policy; akR-* roles stay grouping-only. Grant the deployer auth/oidc/* and identity group management, both of which it currently lacks. AppRole capabilities are fixed at login, so these land in an apply before the resources that need them.
26 lines
880 B
YAML
26 lines
880 B
YAML
# Default OIDC login role (the mount's default_role), used by both the web UI
|
|
# and `bao login -method=oidc`.
|
|
#
|
|
# The role grants no policies of its own: authorization comes from the external
|
|
# identity groups under config/auth_oidc_group, matched on the ak_groups claim.
|
|
# ak_groups is Authentik's hierarchy-expanding claim (plain `groups` only carries
|
|
# direct memberships), so nested akP-* permission groups resolve.
|
|
#
|
|
# allowed_redirect_uris must match the provider's strict URIs exactly.
|
|
---
|
|
user_claim: "email"
|
|
groups_claim: "ak_groups"
|
|
oidc_scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- ak_groups
|
|
bound_audiences:
|
|
- vault
|
|
allowed_redirect_uris:
|
|
- "http://localhost:8250/oidc/callback"
|
|
- "https://vault.k8s.syd1.au.unkin.net/ui/vault/auth/oidc/oidc/callback"
|
|
- "https://vault.service.consul:8200/ui/vault/auth/oidc/oidc/callback"
|
|
token_ttl: 3600
|
|
token_max_ttl: 28800
|