mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 23:41:43 +01:00
fix(nubus): Drop old files
This commit is contained in:
Jaime Conde
committed by
Carlos García-Mauriño
Carlos García-Mauriño
parent
c15fb90ef3
commit
f626b81c53
@@ -1,889 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
global:
|
|
||||||
domain: "{{ .Values.global.domain }}"
|
|
||||||
hosts:
|
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
image:
|
|
||||||
registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
|
|
||||||
repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
|
|
||||||
tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
|
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
|
|
||||||
cleanup:
|
|
||||||
deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
|
|
||||||
keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
|
|
||||||
|
|
||||||
config:
|
|
||||||
custom:
|
|
||||||
clientScopes:
|
|
||||||
{{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
|
|
||||||
clients:
|
|
||||||
{{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
|
|
||||||
keycloak:
|
|
||||||
adminUser: "kcadmin"
|
|
||||||
adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
|
|
||||||
realm: {{ .Values.platform.realm | quote }}
|
|
||||||
intraCluster:
|
|
||||||
enabled: true
|
|
||||||
internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
|
|
||||||
twoFactorSettings:
|
|
||||||
additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
|
|
||||||
opendesk:
|
|
||||||
# We use client specific scopes as we bind them to Keycloak role membership which itself is linked
|
|
||||||
# to LDAP group membership to ensure a user cannot access an application without the required
|
|
||||||
# group membership.
|
|
||||||
# ToDo:
|
|
||||||
# - Jitsi does currently not care if it gets scopes/claims as long as the user is authenticated.
|
|
||||||
clientScopes:
|
|
||||||
- name: "read_contacts"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
- name: "write_contacts"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
- name: "opendesk-openproject-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's OpenProject instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendeskProjectmanagementAdmin"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "opendeskProjectmanagementAdmin"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "openproject_admin"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "given name"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "firstName"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "given_name"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "family name"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "lastName"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "family_name"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-jitsi-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's Jitsi instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "full name"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-full-name-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
id.token.claim: true
|
|
||||||
introspection.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-nextcloud-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's Nextcloud instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "context"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "oxContextIDNum"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "context"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-matrix-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's Matrix instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "full name"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-full-name-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
id.token.claim: true
|
|
||||||
introspection.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-xwiki-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's XWiki instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "full name"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-full-name-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
id.token.claim: true
|
|
||||||
introspection.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
introspection.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-dovecot-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's Dovecot instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk-oxappsuite-scope"
|
|
||||||
description: "Scope for the claims required by openDesk's OX Appuite instance."
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "context"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "oxContextIDNum"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "context"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_useruuid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_useruuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "opendesk_username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "opendesk_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
clients:
|
|
||||||
- name: "opendesk-dovecot"
|
|
||||||
clientId: "opendesk-dovecot"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: false
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-dovecot-scope"
|
|
||||||
- name: "opendesk-intercom"
|
|
||||||
clientId: "opendesk-intercom"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: true
|
|
||||||
backchannel.logout.revoke.offline.tokens: true
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
|
|
||||||
protocolMappers:
|
|
||||||
- name: "intercom-audience"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "opendesk-intercom"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
# temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
|
|
||||||
# it to `opendesk_useruuid` standard claim. For reference:
|
|
||||||
# https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
|
|
||||||
- name: "entryuuid_temp"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "entryUUID"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "entryuuid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
# temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
|
|
||||||
# set it to `opendesk_username` standard claim. For reference:
|
|
||||||
# https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
|
|
||||||
- name: "phoenixusername_temp"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "phoenixusername"
|
|
||||||
jsonType.label: "String"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "offline_access"
|
|
||||||
- name: "opendesk-jitsi"
|
|
||||||
clientId: "opendesk-jitsi"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}/*"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: true
|
|
||||||
fullScopeAllowed: true
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-jitsi-scope"
|
|
||||||
- name: "opendesk-matrix"
|
|
||||||
clientId: "opendesk-matrix"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
standardFlowEnabled: true
|
|
||||||
directAccessGrantsEnabled: true
|
|
||||||
serviceAccountsEnabled: true
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: true
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-matrix-scope"
|
|
||||||
# The following is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID.
|
|
||||||
# Unless that is solved and also is able to use "opendesk-matrix" we keep that dummy client that
|
|
||||||
- name: "matrix"
|
|
||||||
clientId: "matrix"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
standardFlowEnabled: true
|
|
||||||
directAccessGrantsEnabled: true
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes: []
|
|
||||||
optionalClientScopes: []
|
|
||||||
- name: "opendesk-nextcloud"
|
|
||||||
clientId: "opendesk-nextcloud"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: true
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-nextcloud-scope"
|
|
||||||
- "read_contacts"
|
|
||||||
- "write_contacts"
|
|
||||||
- name: "opendesk-openproject"
|
|
||||||
clientId: "opendesk-openproject"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
serviceAccountsEnabled: true
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: true
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-openproject-scope"
|
|
||||||
- name: "opendesk-oxappsuite"
|
|
||||||
clientId: "opendesk-oxappsuite"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: true
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-oxappsuite-scope"
|
|
||||||
- "read_contacts"
|
|
||||||
- "write_contacts"
|
|
||||||
- name: "opendesk-xwiki"
|
|
||||||
clientId: "opendesk-xwiki"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
consentRequired: false
|
|
||||||
frontchannelLogout: false
|
|
||||||
publicClient: false
|
|
||||||
authorizationServicesEnabled: false
|
|
||||||
attributes:
|
|
||||||
backchannel.logout.session.required: false
|
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
|
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "opendesk-xwiki-scope"
|
|
||||||
- name: "guardian-management-api"
|
|
||||||
clientId: "guardian-management-api"
|
|
||||||
rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
publicClient: false
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
|
|
||||||
fullScopeAllowed: true
|
|
||||||
standardFlowEnabled: true
|
|
||||||
implicitFlowEnabled: false
|
|
||||||
directAccessGrantsEnabled: false
|
|
||||||
serviceAccountsEnabled: true
|
|
||||||
protocolMappers:
|
|
||||||
- name: "Client Host"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
user.session.note: "clientHost"
|
|
||||||
userinfo.token.claim: true
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "clientHost"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "Client ID"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
user.session.note: "client_id"
|
|
||||||
userinfo.token.claim: true
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "client_id"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "guardian-audience"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian"
|
|
||||||
userinfo.token.claim: false
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
- name: "audiencemap"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian-cli"
|
|
||||||
userinfo.token.claim: true
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
- name: "dn"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: false
|
|
||||||
user.attribute: "LDAP_ENTRY_DN"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "dn"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "username"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "preferred_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "uid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "uid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "Client IP Address"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
user.session.note: "clientAddress"
|
|
||||||
userinfo.token.claim: true
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "clientAddress"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "guardian-scripts"
|
|
||||||
clientId: "guardian-scripts"
|
|
||||||
description: ""
|
|
||||||
rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
adminUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
surrogateAuthRequired: false
|
|
||||||
enabled: true
|
|
||||||
alwaysDisplayInConsole: false
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
|
|
||||||
webOrigins:
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
bearerOnly: false
|
|
||||||
consentRequired: false
|
|
||||||
standardFlowEnabled: true
|
|
||||||
implicitFlowEnabled: false
|
|
||||||
directAccessGrantsEnabled: true
|
|
||||||
serviceAccountsEnabled: false
|
|
||||||
publicClient: true
|
|
||||||
frontchannelLogout: false
|
|
||||||
protocol: "openid-connect"
|
|
||||||
fullScopeAllowed: true
|
|
||||||
protocolMappers:
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "guardian-audience"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: false
|
|
||||||
- name: "username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "username"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "preferred_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "uid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "uid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "audiencemap"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian-scripts"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
- name: "dn"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
aggregate.attrs: false
|
|
||||||
multivalued: false
|
|
||||||
userinfo.token.claim: false
|
|
||||||
user.attribute: "LDAP_ENTRY_DN"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "dn"
|
|
||||||
jsonType.label: "String"
|
|
||||||
defaultClientScopes:
|
|
||||||
- "web-origins"
|
|
||||||
- "acr"
|
|
||||||
- "roles"
|
|
||||||
- "profile"
|
|
||||||
- "email"
|
|
||||||
optionalClientScopes:
|
|
||||||
- "address"
|
|
||||||
- "phone"
|
|
||||||
- "offline_access"
|
|
||||||
- "microprofile-jwt"
|
|
||||||
- name: "guardian-ui"
|
|
||||||
clientId: "guardian-ui"
|
|
||||||
rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
clientAuthenticatorType: "client-secret"
|
|
||||||
redirectUris:
|
|
||||||
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
|
|
||||||
standardFlowEnabled: true
|
|
||||||
publicClient: true
|
|
||||||
implicitFlowEnabled: false
|
|
||||||
directAccessGrantsEnabled: false
|
|
||||||
serviceAccountsEnabled: false
|
|
||||||
protocol: "openid-connect"
|
|
||||||
fullScopeAllowed: true
|
|
||||||
protocolMappers:
|
|
||||||
- name: "uid"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "uid"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "uid"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "username"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "username"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "preferred_username"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "dn"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-attribute-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: "false"
|
|
||||||
user.attribute: "LDAP_ENTRY_DN"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "dn"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "audiencemap"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: true
|
|
||||||
- name: "email"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-usermodel-property-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
userinfo.token.claim: true
|
|
||||||
user.attribute: "email"
|
|
||||||
id.token.claim: true
|
|
||||||
access.token.claim: true
|
|
||||||
claim.name: "email"
|
|
||||||
jsonType.label: "String"
|
|
||||||
- name: "guardian-audience"
|
|
||||||
protocol: "openid-connect"
|
|
||||||
protocolMapper: "oidc-audience-mapper"
|
|
||||||
consentRequired: false
|
|
||||||
config:
|
|
||||||
included.client.audience: "guardian"
|
|
||||||
id.token.claim: false
|
|
||||||
access.token.claim: true
|
|
||||||
userinfo.token.claim: false
|
|
||||||
|
|
||||||
containerSecurityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
enabled: true
|
|
||||||
privileged: false
|
|
||||||
runAsUser: 1000
|
|
||||||
runAsGroup: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
seLinuxOptions:
|
|
||||||
{{ .Values.seLinuxOptions.opendeskKeycloakBootstrap | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
podAnnotations:
|
|
||||||
intents.otterize.com/service-name: "ums-keycloak-bootstrap"
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
enabled: true
|
|
||||||
fsGroup: 1000
|
|
||||||
fsGroupChangePolicy: "OnRootMismatch"
|
|
||||||
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}
|
|
||||||
|
|
||||||
...
|
|
||||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user