unkin-agent
a1e7029615
ci/woodpecker/push/apply Pipeline failed
## Why
Human login to OpenBao is LDAP-only, so operators keep a second credential set outside Authentik and group membership is maintained twice.
## How
- Add `auth_oidc_backend` module: `oidc`-type JWT auth mount, Authentik discovery URL, `listing_visibility: unauth`, credentials from `kv/service/authentik/oidc-vault`.
- Add `auth_oidc_role` module: oidc role with `user_claim` email, `groups_claim` `ak_groups`, scopes `openid profile email ak_groups`, the registered redirect URIs, `bound_audiences` `[vault]`.
- Add `auth_oidc_group` module: external identity group plus group alias on the OIDC mount accessor, policies from `policy_auth_map`.
- Add config under `config/auth_oidc_{backend,role,group}/`, discovery locals in `config/config.hcl`, `vault_cluster` variables and wiring, and terragrunt inputs.
- Bind `akP-vault-admin` on the `oidc` mount to `global-root`, alongside the existing LDAP `vault_admin` binding.
- Pin the mount path to the literal `oidc`: the registered redirect URIs embed `/ui/vault/auth/oidc/oidc/callback`.
Requires #146, terraform-authentik #33 and #148 applied first.
---------
Co-authored-by: BenVincent <benvin@main.unkin.net>
Reviewed-on: #147
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
57 lines
1.6 KiB
Terraform
57 lines
1.6 KiB
Terraform
variable "backend" {
|
|
description = "The unique path of the OIDC auth backend to configure"
|
|
type = string
|
|
}
|
|
|
|
variable "role_name" {
|
|
description = "The name of the role"
|
|
type = string
|
|
}
|
|
|
|
variable "user_claim" {
|
|
description = "Claim used as the entity alias name (the Vault identity of the human)"
|
|
type = string
|
|
default = "email"
|
|
}
|
|
|
|
variable "groups_claim" {
|
|
description = "Claim holding the caller's group memberships, matched against identity group aliases"
|
|
type = string
|
|
default = "ak_groups"
|
|
}
|
|
|
|
variable "oidc_scopes" {
|
|
description = "Scopes requested from the identity provider during the authorization request"
|
|
type = list(string)
|
|
default = []
|
|
}
|
|
|
|
variable "bound_audiences" {
|
|
description = "List of audiences (aud claim) accepted in the ID token"
|
|
type = list(string)
|
|
default = []
|
|
}
|
|
|
|
variable "allowed_redirect_uris" {
|
|
description = "Redirect URIs accepted for this role. Must match the provider's registered URIs exactly"
|
|
type = list(string)
|
|
}
|
|
|
|
variable "token_ttl" {
|
|
description = "The TTL period of tokens issued using this role, in seconds"
|
|
type = number
|
|
default = 3600
|
|
}
|
|
|
|
variable "token_max_ttl" {
|
|
description = "The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time."
|
|
type = number
|
|
default = 28800
|
|
}
|
|
|
|
variable "token_policies" {
|
|
description = "List of policies to assign to the role (passed from policy_auth_map). Human authorization normally comes from external identity groups instead"
|
|
type = list(string)
|
|
default = []
|
|
}
|