dataset/seed/lemonldap/templates/lmConf-1.json

207 lines
7.1 KiB
JSON
Raw Normal View History

2022-03-08 19:42:28 +01:00
{
2023-06-23 08:12:05 +02:00
"mailFrom" : "{{ general.lemonldap.lemon_mail_admin }}",
2022-03-08 19:42:28 +01:00
"mailLDAPFilter" : "(&(mail=$mail)(objectClass=inetOrgPerson))",
2022-03-29 16:33:20 +02:00
"portalSkinBackground" : "",
"portalCustomCss": "risotto/risotto.css",
2022-03-08 19:42:28 +01:00
"authentication" : "LDAP",
"AuthLDAPFilter" : "(&(cn=$user)(objectClass=inetOrgPerson))",
2023-06-23 08:12:05 +02:00
"managerDn" : "{{ general.ldap.client.ldapclient_user }}",
"managerPassword" : "{{ general.ldap.client.ldapclient_user_password }}",
2022-03-08 19:42:28 +01:00
"ldapPpolicyControl" : 1,
"ldapAllowResetExpiredPassword" : 1,
"ldapChangePasswordAsUser" : 1,
2023-06-23 08:12:05 +02:00
"ldapBase" : "{{ general.ldap.client.ldapclient_search_dn }}",
2022-03-08 19:42:28 +01:00
"ldapExportedVars" : {
"uid" : "uid",
"cn" : "cn",
"sn" : "sn",
"mail" : "mail",
2022-05-04 10:29:03 +02:00
"givenName" : "givenName",
"home" : "homeDirectory"
2022-03-08 19:42:28 +01:00
},
2023-06-23 08:12:05 +02:00
"ldapGroupBase" : "{{ general.ldap.client.ldapclient_group_dn }}",
2022-06-24 19:00:16 +02:00
"ldapGroupAttributeName" : "member",
2022-03-08 19:42:28 +01:00
"ldapGroupAttributeNameUser" : "cn",
2022-06-24 19:00:16 +02:00
"ldapGroupAttributeNameGroup" : "dn",
"ldapGroupAttributeNameSearch" : "cn",
"ldapGroupAttributeNameUser" : "dn",
"ldapGroupObjectClass" : "groupOfNames",
2022-03-08 19:42:28 +01:00
"ldapPort" : "636",
2023-06-23 08:12:05 +02:00
"ldapServer" : "ldaps://{{ general.ldap.server.ldap_server_address }}",
2022-03-08 19:42:28 +01:00
"ldapVerify" : "required",
"ldapTimeout" : 120,
2022-05-07 08:11:18 +02:00
"cfgAuthor" : "Risotto",
2022-03-08 19:42:28 +01:00
"cfgNum" : 1,
"cfgVersion" : "2.0.9",
"demoExportedVars" : {
"cn" : "cn",
"mail" : "mail",
"uid" : "uid"
},
2023-06-23 08:12:05 +02:00
"domain" : "{{ general.revprox.revprox_client.revprox_client_external_domainnames[0] }}",
2022-03-08 19:42:28 +01:00
"exportedVars" : {
"UA" : "HTTP_USER_AGENT",
"cn" : "cn",
"mail" : "mail"
},
"globalStorageOptions" : {
"Directory" : "/srv/lemonldap-ng/sessions",
"LockDirectory" : "/srv/lemonldap-ng/sessions/lock"
},
"issuerDBOpenIDConnectActivation" : 1,
"localSessionStorageOptions" : {
"cache_depth" : 3,
"cache_root" : "/srv/lemonldap-ng/cache",
"default_expires_in" : 600,
"directory_umask" : "007",
"namespace" : "lemonldap-ng-sessions"
},
"locationRules" : {
2023-06-23 08:12:05 +02:00
"{{ general.revprox.revprox_client.revprox_client_external_domainnames[0] }}" : {
2022-03-08 19:42:28 +01:00
"default" : "accept"
2023-06-23 08:12:05 +02:00
{% set domains = [] %}
{% for app in oauth2.remotes %}
{% set key = app|normalize_family %}
{% for external in oauth2['oauth2_' + key]['external_' + key]['hosts_' + key] %}
{% set domain = (external|string).split('/', 3)[-2] %}
{% if domain not in domains %}
2022-06-24 19:00:16 +02:00
},
2023-06-23 08:12:05 +02:00
"{{ domain }}" : {
2022-06-24 19:00:16 +02:00
"^/logout" : "logout_sso",
2023-06-23 08:12:05 +02:00
"default" : "$groups eq \"{{ external['family_' + key] }}\""
{{ domains.append(domain) }}
{% endif %}
{% endfor %}
{% endfor %}
2022-03-08 19:42:28 +01:00
}
},
"loginHistoryEnabled" : 1,
"macros" : {
"UA" : "$ENV{HTTP_USER_AGENT}",
"_whatToTrace" : "$_auth eq 'SAML' ? lc($_user.'@'.$_idpConfKey) : $_auth eq 'OpenIDConnect' ? lc($_user.'@'.$_oidc_OP) : lc($_user)"
},
2023-06-23 08:12:05 +02:00
"mailUrl" : "https://{{ general.revprox.revprox_client.revprox_client_external_domainnames[0] }}/resetpwd",
2022-03-08 19:42:28 +01:00
"mySessionAuthorizedRWKeys" : [
"_appsListOrder",
"_oidcConnectedRP",
"_oidcConsents"
],
"notification" : 1,
"notificationStorageOptions" : {
"dirName" : "/srv/lemonldap-ng/notifications"
},
"oidcRPMetaDataExportedVars" : {
2023-06-23 08:12:05 +02:00
{% set len_app = oauth2.remotes|length %}
{% for app in oauth2.remotes %}
{% set key = app|normalize_family %}
{% set description = oauth2['oauth2_' + key]['description_' + key] %}
"{{ app }}" : {
2022-03-08 19:42:28 +01:00
"email" : "mail",
"family_name" : "sn",
"name" : "cn",
2022-05-04 10:29:03 +02:00
"nickname" : "uid",
"home" : "home"
2023-06-23 08:12:05 +02:00
{% if len_app == loop.index %}
2022-03-08 19:42:28 +01:00
}
2023-06-23 08:12:05 +02:00
{% else %}
2022-03-08 19:42:28 +01:00
},
2023-06-23 08:12:05 +02:00
{% endif %}
{% endfor %}
2022-03-08 19:42:28 +01:00
},
"oidcRPMetaDataOptions" : {
2023-06-23 08:12:05 +02:00
{% for app in oauth2.remotes %}
{% set key = app|normalize_family %}
{% set description = oauth2['oauth2_' + key]['description_' + key] %}
"{{ app }}" : {
2022-03-08 19:42:28 +01:00
"oidcRPMetaDataOptionsAllowClientCredentialsGrant" : 0,
"oidcRPMetaDataOptionsAllowOffline" : 1,
"oidcRPMetaDataOptionsAllowPasswordGrant" : 0,
"oidcRPMetaDataOptionsBypassConsent" : 1,
2023-06-23 08:12:05 +02:00
"oidcRPMetaDataOptionsClientID" : "{{ oauth2['oauth2_' + key]['client_id_' + key] }}",
"oidcRPMetaDataOptionsClientSecret" : "{{ oauth2['oauth2_' + key]['secret_' + key] }}",
2022-03-08 19:42:28 +01:00
"oidcRPMetaDataOptionsIDTokenForceClaims" : 0,
2023-06-23 08:12:05 +02:00
"oidcRPMetaDataOptionsIDTokenSignAlg" : "{{ oauth2['oauth2_' + key]['token_signature_algo_' + key] }}",
2022-03-08 19:42:28 +01:00
"oidcRPMetaDataOptionsLogoutSessionRequired" : 0,
"oidcRPMetaDataOptionsLogoutType" : "front",
"oidcRPMetaDataOptionsPublic" : 0,
2023-06-23 08:12:05 +02:00
{% if oauth2['oauth2_' + key]['login_' + key] %}
"oidcRPMetaDataOptionsRedirectUris" : "{{ oauth2['oauth2_' + key]['login_' + key] }}",
{% endif %}
2022-03-08 19:42:28 +01:00
"oidcRPMetaDataOptionsRefreshToken" : 0,
"oidcRPMetaDataOptionsRequirePKCE" : 0
2023-06-23 08:12:05 +02:00
{% if len_app == loop.index %}
2022-03-08 19:42:28 +01:00
}
2023-06-23 08:12:05 +02:00
{% else %}
2022-03-08 19:42:28 +01:00
},
2023-06-23 08:12:05 +02:00
{% endif %}
{% endfor %}
2022-03-08 19:42:28 +01:00
},
"oidcServiceKeyIdSig" : "2PDCicoyT45rjsARYcxjfg",
"oidcServiceMetaDataAuthnContext" : {
"loa-1" : 1,
"loa-2" : 2,
"loa-3" : 3,
"loa-4" : 4,
"loa-5" : 5
},
2023-06-23 08:12:05 +02:00
{% set tpub = domain_name_eth0|get_public_key(hide=hide_secret) %}
{% set pub = tpub.split("\n")|join('\\n') %}
"oidcServicePublicKeySig" : "{{ pub }}",
{% set tpriv = domain_name_eth0|get_private_key(hide=hide_secret) %}
{% set priv = tpriv.split("\n")|join('\\n') %}
"oidcServicePrivateKeySig" : "{{ priv }}",
2022-03-08 19:42:28 +01:00
"passwordDB" : "LDAP",
"persistentStorage" : "Apache::Session::File",
"persistentStorageOptions" : {
"Directory": "/srv/lemonldap-ng/psessions",
"LockDirectory": "/srv/lemonldap-ng/psessions/lock"
},
2023-06-23 08:12:05 +02:00
"portal" : "https://{{ general.revprox.revprox_client.revprox_client_external_domainnames[0] }}/",
2022-03-29 16:33:20 +02:00
"portalCheckLogins": 0,
"portalDisplayRegister": 0,
"portalDisplayResetPassword": 0,
"portalMainLogo": "risotto/logo.png",
"showLanguages": 0,
2023-06-23 08:12:05 +02:00
"requireToken": "$env->{REMOTE_ADDR} ne '{{ gateway_eth0 }}'",
2022-03-08 19:42:28 +01:00
"whatToTrace" : "_whatToTrace",
2023-06-23 08:12:05 +02:00
{% set remotes = {} %}
{% for app in oauth2.remotes %}
{% set key = app|normalize_family %}
{% set description = oauth2['oauth2_' + key]['description_' + key] %}
{% if description %}
{% set dico = {'key': key,
'description': description,
'logo': "risotto/" + oauth2['oauth2_' + key]['logo_' + key],
'name': oauth2['oauth2_' + key]['name_' + key],
'uri': oauth2['oauth2_' + key]['external_' + key]['hosts_' + key]} %}
{{ remotes.setdefault(oauth2['oauth2_' + key]['category_' + key], []).append(dico) }}
{% endif %}
{% endfor %}
2022-03-08 19:42:28 +01:00
"applicationList" : {
2023-06-23 08:12:05 +02:00
{% for cat in remotes %}
{% if loop.index != 1 %}
2022-03-29 16:33:20 +02:00
,
2023-06-23 08:12:05 +02:00
{% endif %}
"cat_{{ loop.index - 1 }}" : {
"catname" : "{{ cat }}",
{% for dico in remotes[cat] %}
{% for uri in dico['uri'] %}
"{{ dico['key'] }}_{{ loop.index - 1 }}" : {
2022-03-08 19:42:28 +01:00
"options" : {
2023-06-23 08:12:05 +02:00
"description" : "{{ dico['description'] }}",
2022-03-08 19:42:28 +01:00
"display" : "auto",
2023-06-23 08:12:05 +02:00
"logo" : "{{ dico['logo'] }}",
"name" : "{{ dico['name'] }}",
"uri" : "{{ uri }}"
2022-03-08 19:42:28 +01:00
},
"type" : "application"
},
2023-06-23 08:12:05 +02:00
{% endfor %}
{% endfor %}
2022-03-08 19:42:28 +01:00
"type" : "category"
2023-06-23 08:12:05 +02:00
}
{%- endfor -%}
2022-03-29 16:33:20 +02:00
2022-03-08 19:42:28 +01:00
}
}