tegwick
af3b1b0dfb
A client registration flag, signInDiagnosis (default off), makes the callback render uid, sorted groups, assurance and client_id before the redirect, with one continue link to the unchanged code. assurance is aal2 only when this request verified a one-time code. The auth_success log line now carries uid and assurance beside client_id. Enabled for openbao-admin in the dev config; the live flag is documented in docs/operations.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
72 lines
2.7 KiB
YAML
72 lines
2.7 KiB
YAML
issuer: "http://localhost:8080"
|
|
port: 8080
|
|
tokenLifetime: "15m"
|
|
privateKeyPem: "/etc/keycape/key.pem"
|
|
environment: "dev"
|
|
lldap:
|
|
url: "ldap://lldap:3890"
|
|
bindDN: "cn=admin,ou=people,dc=netkingdom,dc=local"
|
|
bindPW: "adminpassword"
|
|
baseDN: "dc=netkingdom,dc=local"
|
|
authelia:
|
|
baseURL: "http://authelia:9091"
|
|
browserBaseURL: "http://localhost:9091"
|
|
tokenBaseURL: "http://authelia:9091"
|
|
clientId: "keycape"
|
|
clientSecret: "changeme"
|
|
redirectURI: "http://localhost:8080/authorize/callback"
|
|
privacyidea:
|
|
baseURL: "http://privacyidea:80"
|
|
adminToken: "changeme"
|
|
realm: "netkingdom"
|
|
clients:
|
|
- clientId: "openbao-admin"
|
|
displayName: "Railiance OpenBao Admin"
|
|
redirectUris:
|
|
- "http://localhost:8250/oidc/callback"
|
|
- "http://127.0.0.1:8250/oidc/callback"
|
|
- "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
- "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback"
|
|
- "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
# NK-WP-0051-T02: show uid/groups/assurance/client_id before returning.
|
|
signInDiagnosis: true
|
|
- clientId: "demo-app"
|
|
displayName: "Demo Application"
|
|
redirectUris:
|
|
- "http://localhost:3000/callback"
|
|
- "http://127.0.0.1:8876/oidc/callback"
|
|
- "http://localhost:8876/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "netkingdom-bootstrap-console"
|
|
displayName: "NetKingdom Bootstrap Console"
|
|
redirectUris:
|
|
- "http://127.0.0.1:8876/oidc/callback"
|
|
- "http://localhost:8876/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "user-engine-portal"
|
|
displayName: "User Engine Portal"
|
|
redirectUris:
|
|
- "https://users.92-205-62-239.nip.io/oidc/callback"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
- clientId: "coulomb-social"
|
|
displayName: "coulomb.social"
|
|
redirectUris:
|
|
- "http://127.0.0.1:8008/auth/callback/"
|
|
- "http://localhost:8008/auth/callback/"
|
|
- "https://coulomb.social/auth/callback/"
|
|
allowedScopes: ["openid", "profile", "email", "groups"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
# Ordinary login is AAL1; acr_values=aal2 still forces step-up.
|
|
# Other clients keep the provider default (mandatory MFA).
|
|
mfaRequired: false
|
|
registrationUrl: "https://users.92-205-62-239.nip.io/register"
|