unkin-agent
a1e7029615
ci/woodpecker/push/apply Pipeline failed
## Why
Human login to OpenBao is LDAP-only, so operators keep a second credential set outside Authentik and group membership is maintained twice.
## How
- Add `auth_oidc_backend` module: `oidc`-type JWT auth mount, Authentik discovery URL, `listing_visibility: unauth`, credentials from `kv/service/authentik/oidc-vault`.
- Add `auth_oidc_role` module: oidc role with `user_claim` email, `groups_claim` `ak_groups`, scopes `openid profile email ak_groups`, the registered redirect URIs, `bound_audiences` `[vault]`.
- Add `auth_oidc_group` module: external identity group plus group alias on the OIDC mount accessor, policies from `policy_auth_map`.
- Add config under `config/auth_oidc_{backend,role,group}/`, discovery locals in `config/config.hcl`, `vault_cluster` variables and wiring, and terragrunt inputs.
- Bind `akP-vault-admin` on the `oidc` mount to `global-root`, alongside the existing LDAP `vault_admin` binding.
- Pin the mount path to the literal `oidc`: the registered redirect URIs embed `/ui/vault/auth/oidc/oidc/callback`.
Requires #146, terraform-authentik #33 and #148 applied first.
---------
Co-authored-by: BenVincent <benvin@main.unkin.net>
Reviewed-on: #147
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
18 lines
812 B
YAML
18 lines
812 B
YAML
# Authentik (OIDC) human SSO. The mount path is the filename and MUST stay
|
|
# "oidc": the Authentik provider registers strict redirect URIs containing
|
|
# /ui/vault/auth/oidc/oidc/callback, which encode the mount path.
|
|
#
|
|
# identity.unkin.net serves the public LetsEncrypt wildcard, so the OpenBao VMs
|
|
# validate discovery against the system roots with no CA bundle work. Do not
|
|
# swap it for identity.k8s.syd1.au.unkin.net (internal CA).
|
|
#
|
|
# listing_visibility unauth makes OIDC the offered default on the UI login page.
|
|
# client_id/client_secret are read from kv/service/authentik/oidc-vault.
|
|
---
|
|
oidc_discovery_url: "https://identity.unkin.net/application/o/vault/"
|
|
default_role: "default"
|
|
description: "Authentik SSO - default human login"
|
|
listing_visibility: "unauth"
|
|
default_lease_ttl: 24h
|
|
max_lease_ttl: 168h
|