140 lines
4.5 KiB
YAML
140 lines
4.5 KiB
YAML
# au rand() {
|
|
# docker run --rm authelia/authelia:latest authelia crypto rand --length $1 --charset rfc3986
|
|
# }
|
|
# au hash() {
|
|
# docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length $1 --random.charset rfc3986
|
|
# }
|
|
identity_providers:
|
|
oidc:
|
|
hmac_secret: '$(au rand 72)'
|
|
jwks:
|
|
- key: $(openssl genrsa -out - 2048)
|
|
claims_policies:
|
|
karakeep:
|
|
id_token: ['email']
|
|
## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
|
|
## See: https://www.authelia.com/c/oidc
|
|
clients:
|
|
- client_name: 'Gitea'
|
|
client_id: '$(au rand 72)'
|
|
client_secret: '$(au hash 72)'
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
require_pkce: false
|
|
pkce_challenge_method: ''
|
|
redirect_uris:
|
|
- 'https://gitea.loadingm.xyz/user/oauth2/authelia/callback'
|
|
scopes:
|
|
- 'openid'
|
|
- 'email'
|
|
- 'profile'
|
|
response_types:
|
|
- 'code'
|
|
grant_types:
|
|
- 'authorization_code'
|
|
access_token_signed_response_alg: 'none'
|
|
userinfo_signed_response_alg: 'none'
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
- client_name: 'Memos'
|
|
client_id: '$(au rand 72)'
|
|
client_secret: '$(au hash 72)'
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
require_pkce: false
|
|
pkce_challenge_method: ''
|
|
redirect_uris:
|
|
- 'https://memos.loadingm.xyz/auth/callback'
|
|
scopes:
|
|
- 'openid'
|
|
- 'email'
|
|
- 'profile'
|
|
response_types:
|
|
- 'code'
|
|
grant_types:
|
|
- 'authorization_code'
|
|
access_token_signed_response_alg: 'none'
|
|
userinfo_signed_response_alg: 'none'
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
- client_name: 'Open WebUI'
|
|
client_id: '$(au rand 72)'
|
|
client_secret: '$(au hash 72)'
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
require_pkce: false
|
|
pkce_challenge_method: ''
|
|
redirect_uris:
|
|
- 'https://ollama.loadingm.xyz/oauth/oidc/callback'
|
|
scopes:
|
|
- 'openid'
|
|
- 'email'
|
|
- 'groups'
|
|
- 'profile'
|
|
response_types:
|
|
- 'code'
|
|
grant_types:
|
|
- 'authorization_code'
|
|
access_token_signed_response_alg: 'none'
|
|
userinfo_signed_response_alg: 'none'
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
- client_name: 'Karakeep'
|
|
client_id: '$(au rand 72)'
|
|
client_secret: '$(au hash 72)'
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
require_pkce: false
|
|
pkce_challenge_method: ''
|
|
redirect_uris:
|
|
- 'https://karakeep.loadingm.xyz/api/auth/callback/custom'
|
|
scopes:
|
|
- 'openid'
|
|
- 'email'
|
|
- 'profile'
|
|
claims_policy: 'karakeep'
|
|
response_types:
|
|
- 'code'
|
|
grant_types:
|
|
- 'authorization_code'
|
|
access_token_signed_response_alg: 'none'
|
|
userinfo_signed_response_alg: 'none'
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
# - client_name: 'Jellyseerr'
|
|
# client_id: '$(au rand 72)'
|
|
# client_secret: '$(au hash 72)'
|
|
# public: false
|
|
# authorization_policy: 'two_factor'
|
|
# require_pkce: false
|
|
# pkce_challenge_method: ''
|
|
# redirect_uris:
|
|
# - 'https://memos.loadingm.xyz/auth/callback'
|
|
# scopes:
|
|
# - 'openid'
|
|
# - 'email'
|
|
# - 'profile'
|
|
# response_types:
|
|
# - 'code'
|
|
# grant_types:
|
|
# - 'authorization_code'
|
|
# access_token_signed_response_alg: 'none'
|
|
# userinfo_signed_response_alg: 'none'
|
|
# token_endpoint_auth_method: 'client_secret_basic'
|
|
# - client_name: 'Jellyfin'
|
|
# client_id: '$(au rand 72)'
|
|
# client_secret: '$(au hash 72)'
|
|
# public: false
|
|
# authorization_policy: 'two_factor'
|
|
# require_pkce: false
|
|
# pkce_challenge_method: ''
|
|
# redirect_uris:
|
|
# - 'https://memos.loadingm.xyz/auth/callback'
|
|
# scopes:
|
|
# - 'openid'
|
|
# - 'email'
|
|
# - 'profile'
|
|
# response_types:
|
|
# - 'code'
|
|
# grant_types:
|
|
# - 'authorization_code'
|
|
# access_token_signed_response_alg: 'none'
|
|
# userinfo_signed_response_alg: 'none'
|
|
# token_endpoint_auth_method: 'client_secret_basic'
|