Initial commit

tests/example-vars.yml

@@ -0,0 +1,48 @@
+---
+# Passwords supplied in a Vault-encrypted inventory, never in this example.
+dex_issuer: https://dex.eom.dev/
+dex_hostname: dex.eom.dev
+dex_postgres_manage: false
+dex_postgres_host: postgresql
+dex_postgres_database: dex
+dex_postgres_user: dex
+# Legacy credential names are still supported by defaults:
+# dex_admin_password, openldap_readonly_password, matrix_dex_oidc_client_secret.
+
+# Existing Secret in the Dex namespace. WWW_DEX_CLIENT_SECRET must match the
+# www membership app's DEX_CLIENT_SECRET. DEX_LDAP_BIND_PASSWORD is the search
+# account password; no real values go in this public file.
+dex_env_secret_name: dex-client-secrets
+dex_static_clients:
+  - id: www-membership
+    name: eom.dev Membership
+    secretEnv: WWW_DEX_CLIENT_SECRET
+    redirectURIs:
+      - https://www.eom.dev/members/oidc/callback/
+
+# Additional connector: don't alter legacy ldap/idAttr uid, which changes sub
+# identifiers for existing applications. This connector admits free web accounts.
+dex_additional_connectors:
+  - type: ldap
+    id: www-ldap
+    name: eom.dev Membership
+    config:
+      host: openldap.openldap.svc.cluster.local
+      insecureNoSSL: true
+      bindDN: cn=readonly,dc=eom,dc=dev
+      bindPW: $DEX_LDAP_BIND_PASSWORD
+      userSearch:
+        baseDN: ou=people,dc=eom,dc=dev
+        filter: "(objectClass=inetOrgPerson)"
+        username: uid
+        idAttr: entryUUID
+        emailAttr: mail
+        nameAttr: cn
+        preferredUsernameAttr: uid
+      groupSearch:
+        baseDN: ou=groups,dc=eom,dc=dev
+        filter: "(objectClass=groupOfUniqueNames)"
+        userMatchers:
+          - userAttr: DN
+            groupAttr: uniqueMember
+        nameAttr: cn