sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: patch oauth2-proxy to support scopes as groups

Browse source
This commit is contained in:
oddlama 2023-06-23 15:20:58 +02:00
parent 1a0378ee5c
commit eb9ee0bf0d
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 65 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/oauth2-proxy.nix
View file

@ -99,12 +99,14 @@ in {
cookie.domain = ".${cfg.cookieDomain}";
cookie.secure = true;
cookie.httpOnly = false;
cookie.refresh = "5m";
# FIXME disabled because of errors. My closest guess is that this
# reuses refresh tokens but kanidm forbids that. Not sure though.
#cookie.refresh = "5m";
cookie.expire = "30m";
reverseProxy = true;
httpAddress = "unix:///run/oauth2_proxy/oauth2_proxy.sock";
redirectURL = "https://${cfg.portalDomain}/oauth2/callback";
setXauthrequest = true;
extraConfig = {
@ -112,12 +114,10 @@ in {
code-challenge-method = "S256";
# Share the cookie with all subpages
whitelist-domain = ".${cfg.cookieDomain}";
redirect-url = "https://${cfg.portalDomain}/oauth2/callback";
set-authorization-header = true;
pass-access-token = true;
skip-jwt-bearer-tokens = true;
upstream = "static://202";
# TODO allowed group?
};
};