49 lines
1.7 KiB
YAML
Executable File
49 lines
1.7 KiB
YAML
Executable File
---
|
|
# Passwords supplied in a Vault-encrypted inventory, never in this example.
|
|
dex_issuer: https://dex.eom.dev/
|
|
dex_hostname: dex.eom.dev
|
|
dex_postgres_manage: false
|
|
dex_postgres_host: postgresql
|
|
dex_postgres_database: dex
|
|
dex_postgres_user: dex
|
|
# Legacy credential names are still supported by defaults:
|
|
# dex_admin_password, openldap_readonly_password, matrix_dex_oidc_client_secret.
|
|
|
|
# Existing Secret in the Dex namespace. WWW_DEX_CLIENT_SECRET must match the
|
|
# www membership app's DEX_CLIENT_SECRET. DEX_LDAP_BIND_PASSWORD is the search
|
|
# account password; no real values go in this public file.
|
|
dex_env_secret_name: dex-client-secrets
|
|
dex_static_clients:
|
|
- id: www-membership
|
|
name: eom.dev Membership
|
|
secretEnv: WWW_DEX_CLIENT_SECRET
|
|
redirectURIs:
|
|
- https://www.eom.dev/members/oidc/callback/
|
|
|
|
# Additional connector: don't alter legacy ldap/idAttr uid, which changes sub
|
|
# identifiers for existing applications. This connector admits free web accounts.
|
|
dex_additional_connectors:
|
|
- type: ldap
|
|
id: www-ldap
|
|
name: eom.dev Membership
|
|
config:
|
|
host: openldap.openldap.svc.cluster.local
|
|
insecureNoSSL: true
|
|
bindDN: cn=readonly,dc=eom,dc=dev
|
|
bindPW: $DEX_LDAP_BIND_PASSWORD
|
|
userSearch:
|
|
baseDN: ou=people,dc=eom,dc=dev
|
|
filter: "(objectClass=inetOrgPerson)"
|
|
username: uid
|
|
idAttr: entryUUID
|
|
emailAttr: mail
|
|
nameAttr: cn
|
|
preferredUsernameAttr: uid
|
|
groupSearch:
|
|
baseDN: ou=groups,dc=eom,dc=dev
|
|
filter: "(objectClass=groupOfUniqueNames)"
|
|
userMatchers:
|
|
- userAttr: DN
|
|
groupAttr: uniqueMember
|
|
nameAttr: cn
|