75 lines
2.2 KiB
HCL
75 lines
2.2 KiB
HCL
data "authentik_flow" "default_authorization_flow" {
|
|
slug = "default-provider-authorization-implicit-consent"
|
|
}
|
|
|
|
data "authentik_certificate_key_pair" "ecdsa" {
|
|
name = "auth.serguzim.me"
|
|
}
|
|
|
|
data "authentik_certificate_key_pair" "rsa" {
|
|
name = "authentik Self-signed Certificate"
|
|
}
|
|
|
|
data "authentik_property_mapping_provider_scope" "default_scopes" {
|
|
managed_list = [
|
|
"goauthentik.io/providers/oauth2/scope-email",
|
|
"goauthentik.io/providers/oauth2/scope-openid",
|
|
"goauthentik.io/providers/oauth2/scope-profile"
|
|
]
|
|
}
|
|
|
|
resource "authentik_user" "default" {
|
|
username = "serguzim"
|
|
name = "Tobias Reisinger"
|
|
email = "tobias@msrg.cc"
|
|
}
|
|
|
|
resource "authentik_property_mapping_provider_scope" "minio" {
|
|
name = "minio"
|
|
scope_name = "minio"
|
|
expression = <<EOF
|
|
if ak_is_group_member(request.user, name="${authentik_group.minio_admins.name}"):
|
|
return {
|
|
"minio_policy": "consoleAdmin",
|
|
}
|
|
elif ak_is_group_member(request.user, name="${authentik_group.minio_users.name}"):
|
|
return {
|
|
"minio_policy": "readonly"
|
|
}
|
|
return None
|
|
EOF
|
|
}
|
|
|
|
resource "authentik_group" "minio_admins" {
|
|
name = "Minio admins"
|
|
users = [authentik_user.default.id]
|
|
}
|
|
|
|
resource "authentik_group" "minio_users" {
|
|
name = "Minio users"
|
|
users = []
|
|
}
|
|
|
|
|
|
resource "authentik_provider_oauth2" "service_providers" {
|
|
for_each = local.services_auth
|
|
name = each.value.name
|
|
client_type = "confidential"
|
|
client_id = each.value.name
|
|
authorization_flow = data.authentik_flow.default_authorization_flow.id
|
|
redirect_uris = each.value.auth_redirects
|
|
property_mappings = flatten([
|
|
data.authentik_property_mapping_provider_scope.default_scopes.ids,
|
|
each.key == "minio" ? [authentik_property_mapping_provider_scope.minio.id] : []
|
|
])
|
|
signing_key = (each.value.auth_cert == "rsa" ?
|
|
data.authentik_certificate_key_pair.rsa.id :
|
|
data.authentik_certificate_key_pair.ecdsa.id)
|
|
}
|
|
|
|
resource "authentik_application" "service_applications" {
|
|
for_each = local.services_auth
|
|
name = each.value.name
|
|
slug = replace(each.value.dns[0].domain, ".", "-")
|
|
protocol_provider = authentik_provider_oauth2.service_providers[each.key].id
|
|
}
|