tegwick
145ca8e08c
Some checks failed
Custody gains LLDAP_SVC_{AUTHELIA,KEYCAPE,PRIVACYIDEA,PROVISIONER}_PASS and
LLDAP_LDAP_USER_PASS becomes ld-admin's. Authelia, KeyCape, the privacyIDEA
resolver and identity-provisioner (new Secret identity-provisioner-ldap) switch
to svc-* accounts; LLDAP's configured super-admin is ld-admin. The LLDAP image
pin waits for the running digest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
123 lines
3.2 KiB
JSON
123 lines
3.2 KiB
JSON
{
|
|
"issuer": "https://kc.coulomb.social",
|
|
"port": 8080,
|
|
"tokenLifetime": "15m",
|
|
"privateKeyPem": "/etc/keycape/key.pem",
|
|
"environment": "production",
|
|
"lldap": {
|
|
"url": "ldap://lldap.sso.svc.cluster.local:3890",
|
|
"bindDN": "uid=svc-keycape,ou=people,dc=netkingdom,dc=local",
|
|
"bindPW": "",
|
|
"baseDN": "dc=netkingdom,dc=local",
|
|
"userOU": "ou=people",
|
|
"groupOU": "ou=groups"
|
|
},
|
|
"authelia": {
|
|
"baseURL": "http://authelia.sso.svc.cluster.local:9091",
|
|
"browserBaseURL": "https://auth.coulomb.social",
|
|
"tokenBaseURL": "http://authelia.sso.svc.cluster.local:9091",
|
|
"clientId": "keycape",
|
|
"clientSecret": "",
|
|
"redirectURI": "https://kc.coulomb.social/authorize/callback"
|
|
},
|
|
"privacyidea": {
|
|
"baseURL": "http://privacyidea.mfa.svc.cluster.local:8080",
|
|
"realm": "coulomb",
|
|
"requireForAll": true,
|
|
"adminTokenFile": "/etc/keycape-factor/admin-token"
|
|
},
|
|
"clients": [
|
|
{
|
|
"clientId": "demo-app",
|
|
"displayName": "Demo Application",
|
|
"redirectUris": [
|
|
"http://localhost:3000/callback",
|
|
"http://127.0.0.1:8876/oidc/callback",
|
|
"http://localhost:8876/oidc/callback",
|
|
"https://demo.coulomb.social/callback"
|
|
],
|
|
"allowedScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"grantTypes": [
|
|
"authorization_code"
|
|
],
|
|
"clientType": "public"
|
|
},
|
|
{
|
|
"clientId": "user-engine-portal",
|
|
"displayName": "User Engine Portal",
|
|
"redirectUris": [
|
|
"https://users.92-205-62-239.nip.io/oidc/callback",
|
|
"https://users.coulomb.social/oidc/callback"
|
|
],
|
|
"allowedScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"grantTypes": [
|
|
"authorization_code"
|
|
],
|
|
"clientType": "public"
|
|
},
|
|
{
|
|
"clientId": "netkingdom-bootstrap-console",
|
|
"displayName": "NetKingdom Bootstrap Console",
|
|
"redirectUris": [
|
|
"http://127.0.0.1:8876/oidc/callback",
|
|
"http://localhost:8876/oidc/callback"
|
|
],
|
|
"allowedScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"grantTypes": [
|
|
"authorization_code"
|
|
],
|
|
"clientType": "public"
|
|
},
|
|
{
|
|
"clientId": "openbao-admin",
|
|
"displayName": "Railiance OpenBao Admin",
|
|
"redirectUris": [
|
|
"http://localhost:8250/oidc/callback",
|
|
"http://127.0.0.1:8250/oidc/callback",
|
|
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
],
|
|
"allowedScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"groups"
|
|
],
|
|
"grantTypes": [
|
|
"authorization_code"
|
|
],
|
|
"clientType": "public"
|
|
},
|
|
{
|
|
"clientId": "rapp-qonto-client",
|
|
"displayName": "rapp-qonto workload",
|
|
"allowedScopes": [
|
|
"qonto:read"
|
|
],
|
|
"grantTypes": [
|
|
"client_credentials"
|
|
],
|
|
"clientType": "confidential",
|
|
"secretRef": "env:KEYCAPE_RAPP_QONTO_CLIENT_SECRET",
|
|
"serviceSubject": "rapp-qonto",
|
|
"tenant": "tenant:friendly:binky",
|
|
"roles": [
|
|
"qonto-reader"
|
|
]
|
|
}
|
|
]
|
|
}
|