No more sercretString dans oauth2

application/application.tf

@@ -7,14 +7,13 @@ data "authentik_group" "akadmin" {
 }
 resource "authentik_group" "groups" {
   name       = local.main_group
-  attributes = jsonencode({ "${local.app_name}" = var.attributes })
+  attributes = jsonencode({ "${local.app_name}" = true })
 }
 
 resource "authentik_group" "subgroup" {
   count  = length(var.sub_groups)
   name   = format("%s-%s", local.main_group, var.sub_groups[count.index])
   parent = authentik_group.groups.id
-  attributes = length(var.sub_groups_attributes)>count.index?jsonencode({ "${local.app_name}" = var.sub_groups_attributes[count.index] }):jsonencode({ "${local.app_name}" = var.attributes })
 }
 
 resource "authentik_application" "prj_app" {
@@ -31,7 +30,7 @@ resource "authentik_policy_expression" "policy" {
   name       = local.main_group
   expression = <<-EOF
     attr = request.user.group_attributes()
-    return True if '${local.app_name}' in attr else False
+    return attr['${local.app_name}'] if '${local.app_name}' in attr else False
   EOF
 }
 

application/variables.tf

@@ -26,9 +26,3 @@ variable "backchannel_providers" {
   type    = list(number)
   default = null
 }
-variable "attributes" {
-  default = {enable = true}
-}
-variable "sub_groups_attributes" {
-  default = []
-}

saml/outputs.tf

@@ -1,27 +1,3 @@
-output "app_id" {
-  value       = "${local.app_slug}-saml"
-}
 output "provider-id" {
   value       = authentik_provider_saml.prj.id
-}
-output "issuer" {
-  value       = authentik_provider_saml.prj.issuer
-}
-output "url_slo_post" {
-  value       = authentik_provider_saml.prj.url_slo_post
-}
-output "url_slo_redirect" {
-  value       = authentik_provider_saml.prj.url_slo_redirect
-}
-output "url_sso_init" {
-  value       = authentik_provider_saml.prj.url_sso_init
-}
-output "url_sso_post" {
-  value       = authentik_provider_saml.prj.url_sso_post
-}
-output "url_sso_redirect" {
-  value       = authentik_provider_saml.prj.url_sso_redirect
-}
-output "certificate_data" {
-  value       = data.authentik_certificate_key_pair.generated.certificate_data
-}
+}

saml/saml.tf

@@ -1,6 +1,6 @@
 locals{
   app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
-  saml_labels = merge(var.labels, {
+    saml_labels = merge(var.labels, {
     "app.kubernetes.io/component" = "authentik-saml"
   })
 }
@@ -12,7 +12,7 @@ data "authentik_flow" "default-authentication-flow" {
 }
 
 data "authentik_property_mapping_saml" "saml_maps" {
-  managed_list = var.group_mapping==null?[
+  managed_list = [
       "goauthentik.io/providers/saml/email",
       "goauthentik.io/providers/saml/groups",
       "goauthentik.io/providers/saml/name",
@@ -20,24 +20,9 @@ data "authentik_property_mapping_saml" "saml_maps" {
       "goauthentik.io/providers/saml/uid",
       "goauthentik.io/providers/saml/username",
       "goauthentik.io/providers/saml/ms-windowsaccountname",
-  ]:[
-      "goauthentik.io/providers/saml/email",
-      "goauthentik.io/providers/saml/name",
-      "goauthentik.io/providers/saml/upn",
-      "goauthentik.io/providers/saml/uid",
-      "goauthentik.io/providers/saml/username",
-      "goauthentik.io/providers/saml/ms-windowsaccountname",
   ]
 }
 
-resource "authentik_property_mapping_saml" "mapping" {
-  count         = var.group_mapping==null?0:1
-  friendly_name = "groups"
-  name          = "${local.app_slug} Group mapping"
-  saml_name     = "http://schemas.xmlsoap.org/claims/Group"
-  expression    = var.group_mapping
-}
-
 data "authentik_property_mapping_saml" "saml_name" {
   managed = "goauthentik.io/providers/saml/username"
 }
@@ -69,11 +54,9 @@ resource "authentik_provider_saml" "prj" {
   authentication_flow = data.authentik_flow.default-authentication-flow.id
   authorization_flow  = data.authentik_flow.default-authorization-flow.id
   acs_url             = "https://${var.dns_names[0]}/${var.acs_path}"
-  property_mappings   = var.group_mapping==null?data.authentik_property_mapping_saml.saml_maps.ids:concat(data.authentik_property_mapping_saml.saml_maps.ids,[authentik_property_mapping_saml.mapping[0].id])
+  property_mappings   = data.authentik_property_mapping_saml.saml_maps.ids
   name_id_mapping     = data.authentik_property_mapping_saml.saml_name.id
   signing_kp          = data.authentik_certificate_key_pair.generated.id
   sp_binding          = var.binding
-  audience            = var.audience
-  issuer              = var.saml_issuer
 }
 

saml/variables.tf

@@ -17,21 +17,6 @@ variable "binding" {
   type        = string
   default     = "post"
 }
-variable "namespace" {
-  type        = string
-}
 variable "labels" {
   type        = map(string)
 }
-variable "group_mapping" {
-  type        = string
-  default     = null
-}
-variable "audience" {
-  type        = string
-  default     = null
-}
-variable "saml_issuer" {
-  type        = string
-  default     = null
-}