tegwick
b6af6c5268
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 34s
Add signed registration/enrollment handoffs, per-request assurance policy with login-session isolation, and /logout. coulomb-social stays AAL1 unless acr_values or another client raises the bar.
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
issuer: "http://localhost:8080"
|
|
port: 8080
|
|
tokenLifetime: "15m"
|
|
privateKeyPem: "/etc/keycape/key.pem"
|
|
environment: "dev"
|
|
lldap:
|
|
url: "ldap://lldap:3890"
|
|
bindDN: "cn=admin,ou=people,dc=netkingdom,dc=local"
|
|
bindPW: "adminpassword"
|
|
baseDN: "dc=netkingdom,dc=local"
|
|
authelia:
|
|
baseURL: "http://authelia:9091"
|
|
browserBaseURL: "http://localhost:9091"
|
|
tokenBaseURL: "http://authelia:9091"
|
|
clientId: "keycape"
|
|
clientSecret: "changeme"
|
|
redirectURI: "http://localhost:8080/authorize/callback"
|
|
privacyidea:
|
|
baseURL: "http://privacyidea:80"
|
|
adminToken: "changeme"
|
|
realm: "netkingdom"
|
|
clients:
|
|
- clientId: "demo-app"
|
|
displayName: "Demo Application"
|
|
redirectUris:
|
|
- "http://localhost:3000/callback"
|
|
- "http://127.0.0.1:8876/oidc/callback"
|
|
- "http://localhost:8876/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "netkingdom-bootstrap-console"
|
|
displayName: "NetKingdom Bootstrap Console"
|
|
redirectUris:
|
|
- "http://127.0.0.1:8876/oidc/callback"
|
|
- "http://localhost:8876/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "user-engine-portal"
|
|
displayName: "User Engine Portal"
|
|
redirectUris:
|
|
- "https://users.92-205-62-239.nip.io/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "coulomb-social"
|
|
displayName: "coulomb.social"
|
|
redirectUris:
|
|
- "http://127.0.0.1:8008/auth/callback/"
|
|
- "http://localhost:8008/auth/callback/"
|
|
- "https://coulomb.social/auth/callback/"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
# Ordinary login is AAL1; acr_values=aal2 still forces step-up.
|
|
# Other clients keep the provider default (mandatory MFA).
|
|
mfaRequired: false
|
|
registrationUrl: "https://users.92-205-62-239.nip.io/register"
|