vynil/kydah-modules
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

No more sercretString dans oauth2

Browse Source
This commit is contained in:
Sébastien Huss
2024-05-17 16:10:54 +02:00
parent 1c42b356c1
commit 8e883d012e
7 changed files with 88 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
saml/saml.tf
View File

@@ -1,6 +1,6 @@
locals{
app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
saml_labels = merge(var.labels, {
saml_labels = merge(var.labels, {
"app.kubernetes.io/component" = "authentik-saml"
})
}
@@ -12,7 +12,7 @@ data "authentik_flow" "default-authentication-flow" {
}
data "authentik_property_mapping_saml" "saml_maps" {
managed_list = [
managed_list = var.group_mapping==null?[
"goauthentik.io/providers/saml/email",
"goauthentik.io/providers/saml/groups",
"goauthentik.io/providers/saml/name",
@@ -20,9 +20,24 @@ data "authentik_property_mapping_saml" "saml_maps" {
"goauthentik.io/providers/saml/uid",
"goauthentik.io/providers/saml/username",
"goauthentik.io/providers/saml/ms-windowsaccountname",
]:[
"goauthentik.io/providers/saml/email",
"goauthentik.io/providers/saml/name",
"goauthentik.io/providers/saml/upn",
"goauthentik.io/providers/saml/uid",
"goauthentik.io/providers/saml/username",
"goauthentik.io/providers/saml/ms-windowsaccountname",
]
}
resource "authentik_property_mapping_saml" "mapping" {
count = var.group_mapping==null?0:1
friendly_name = "groups"
name = "${local.app_slug} Group mapping"
saml_name = "http://schemas.xmlsoap.org/claims/Group"
expression = var.group_mapping
}
data "authentik_property_mapping_saml" "saml_name" {
managed = "goauthentik.io/providers/saml/username"
}
@@ -54,9 +69,11 @@ resource "authentik_provider_saml" "prj" {
authentication_flow = data.authentik_flow.default-authentication-flow.id
authorization_flow = data.authentik_flow.default-authorization-flow.id
acs_url = "https://${var.dns_names[0]}/${var.acs_path}"
property_mappings = data.authentik_property_mapping_saml.saml_maps.ids
property_mappings = var.group_mapping==null?data.authentik_property_mapping_saml.saml_maps.ids:concat(data.authentik_property_mapping_saml.saml_maps.ids,[authentik_property_mapping_saml.mapping[0].id])
name_id_mapping = data.authentik_property_mapping_saml.saml_name.id
signing_kp = data.authentik_certificate_key_pair.generated.id
sp_binding = var.binding
audience = var.audience
issuer = var.saml_issuer
}