mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: patch oauth2-proxy to support scopes as groups

Browse source
This commit is contained in:
oddlama 2023-06-23 15:20:58 +02:00
parent 1a0378ee5c
commit eb9ee0bf0d
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 65 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hosts/sentinel/oauth2.nix
View file

@ -8,6 +8,7 @@
enable = true;
cookieDomain = config.repo.secrets.local.personalDomain;
portalDomain = "oauth2.${config.repo.secrets.local.personalDomain}";
# TODO portal redirect to dashboard (in case someone clicks on kanidm "Web services")
};
age.secrets.oauth2-proxy-secret = {
@ -16,24 +17,21 @@
group = "oauth2_proxy";
};
services.oauth2_proxy = {
services.oauth2_proxy = let
clientId = "web-sentinel";
in {
provider = "oidc";
scope = "openid email";
loginURL = "https://${config.proxiedDomains.kanidm}/ui/oauth2";
redeemURL = "https://${config.proxiedDomains.kanidm}/oauth2/token";
validateURL = "https://${config.proxiedDomains.kanidm}/oauth2/openid/web-sentinel/userinfo";
clientID = "web-sentinel";
validateURL = "https://${config.proxiedDomains.kanidm}/oauth2/openid/${clientId}/userinfo";
clientID = clientId;
keyFile = config.age.secrets.oauth2-proxy-secret.path;
email.domains = ["*"];
extraConfig = {
# TODO good idea? would fail when offline
# TODO autorestart after 30 minutes, infinite times.
oidc-issuer-url = "https://${config.proxiedDomains.kanidm}/oauth2/openid/web-sentinel";
oidc-issuer-url = "https://${config.proxiedDomains.kanidm}/oauth2/openid/${clientId}";
skip-provider-button = true;
# TODO away
show-debug-on-error = true;
};
};
}