---
# Passwords supplied in a Vault-encrypted inventory, never in this example.
dex_issuer: https://dex.eom.dev/
dex_hostname: dex.eom.dev
dex_postgres_manage: false
dex_postgres_host: postgresql
dex_postgres_database: dex
dex_postgres_user: dex
# Legacy credential names are still supported by defaults:
# dex_admin_password, openldap_readonly_password, matrix_dex_oidc_client_secret.

# Existing Secret in the Dex namespace. WWW_DEX_CLIENT_SECRET must match the
# www membership app's DEX_CLIENT_SECRET. DEX_LDAP_BIND_PASSWORD is the search
# account password; no real values go in this public file.
dex_env_secret_name: dex-client-secrets
dex_static_clients:
  - id: www-membership
    name: eom.dev Membership
    secretEnv: WWW_DEX_CLIENT_SECRET
    redirectURIs:
      - https://www.eom.dev/members/oidc/callback/

# Additional connector: don't alter legacy ldap/idAttr uid, which changes sub
# identifiers for existing applications. This connector admits free web accounts.
dex_additional_connectors:
  - type: ldap
    id: www-ldap
    name: eom.dev Membership
    config:
      host: openldap.openldap.svc.cluster.local
      insecureNoSSL: true
      bindDN: cn=readonly,dc=eom,dc=dev
      bindPW: $DEX_LDAP_BIND_PASSWORD
      userSearch:
        baseDN: ou=people,dc=eom,dc=dev
        filter: "(objectClass=inetOrgPerson)"
        username: uid
        idAttr: entryUUID
        emailAttr: mail
        nameAttr: cn
        preferredUsernameAttr: uid
      groupSearch:
        baseDN: ou=groups,dc=eom,dc=dev
        filter: "(objectClass=groupOfUniqueNames)"
        userMatchers:
          - userAttr: DN
            groupAttr: uniqueMember
        nameAttr: cn