593 lines
24 KiB
YAML
593 lines
24 KiB
YAML
image:
|
|
repository: ghcr.io/authelia/authelia
|
|
pullPolicy: IfNotPresent
|
|
tag: 4.38.8@sha256:19375b10024caeef4e0b119a6247beae84cbaa02c846cfd750e92dea910d4b6a
|
|
|
|
workload:
|
|
main:
|
|
replicas: 2
|
|
strategy: RollingUpdate
|
|
podSpec:
|
|
containers:
|
|
main:
|
|
command:
|
|
- authelia
|
|
args:
|
|
- --config=/configuration.yaml
|
|
envFrom:
|
|
- configMapRef:
|
|
name: authelia-paths
|
|
probes:
|
|
liveness:
|
|
type: http
|
|
path: "/api/health"
|
|
readiness:
|
|
type: http
|
|
path: "/api/health"
|
|
startup:
|
|
type: http
|
|
path: "/api/health"
|
|
service:
|
|
main:
|
|
ports:
|
|
main:
|
|
port: 9091
|
|
targetPort: 9091
|
|
persistence:
|
|
config:
|
|
enabled: true
|
|
mountPath: "/config"
|
|
cnpg:
|
|
main:
|
|
enabled: true
|
|
user: authelia
|
|
database: authelia
|
|
# Enabled redis
|
|
# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
|
|
redis:
|
|
enabled: true
|
|
includeCommon: true
|
|
domain: example.com
|
|
##
|
|
## Server Configuration
|
|
##
|
|
server:
|
|
##
|
|
## Port sets the configured port for the daemon, service, and the probes.
|
|
## Default is 9091 and should not need to be changed.
|
|
##
|
|
port: 9091
|
|
## Buffers usually should be configured to be the same value.
|
|
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
## Write buffer size does the same for outgoing responses.
|
|
read_buffer_size: 4096
|
|
write_buffer_size: 4096
|
|
## Set the single level path Authelia listens on.
|
|
## Must be alphanumeric chars and should not contain any slashes.
|
|
path: ""
|
|
log:
|
|
## Level of verbosity for logs: info, debug, trace.
|
|
level: trace
|
|
## Format the logs are written as: json, text.
|
|
format: text
|
|
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
|
## File path where the logs will be written. If not set logs are written to stdout.
|
|
# file_path: /config/authelia.log
|
|
## Default redirection URL
|
|
##
|
|
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
|
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
|
## in such a case.
|
|
##
|
|
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
|
## Default is https://www.<domain> (value at the top of the values.yaml).
|
|
default_redirection_url: ""
|
|
# default_redirection_url: https://example.com
|
|
|
|
theme: light
|
|
##
|
|
## TOTP Configuration
|
|
##
|
|
## Parameters used for TOTP generation
|
|
totp:
|
|
## The issuer name displayed in the Authenticator application of your choice
|
|
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
|
## Defaults to <domain>.
|
|
issuer: ""
|
|
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
|
## their TOTP applications again. Warning: before changing period read the docs link below.
|
|
period: 30
|
|
## The skew controls number of one-time passwords either side of the current one that are valid.
|
|
## Warning: before changing skew read the docs link below.
|
|
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
|
skew: 1
|
|
##
|
|
## Password Policy Config
|
|
##
|
|
## Parameters used for Password Policies
|
|
password_policy:
|
|
## See: https://www.authelia.com/configuration/security/password-policy/
|
|
standard:
|
|
enabled: false
|
|
min_length: 8
|
|
max_length: 0
|
|
require_uppercase: false
|
|
require_lowercase: false
|
|
require_number: false
|
|
require_special: false
|
|
zxcvbn:
|
|
## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
|
|
enabled: false
|
|
min_score: 3
|
|
##
|
|
## Duo Push API Configuration
|
|
##
|
|
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
|
## "Partner Auth API" in the management panel.
|
|
duo_api:
|
|
enabled: false
|
|
hostname: api-123456789.example.com
|
|
integration_key: ABCDEF
|
|
plain_api_key: ""
|
|
## NTP settings
|
|
ntp:
|
|
address: "time.cloudflare.com:123"
|
|
version: 4
|
|
max_desync: 3s
|
|
disable_startup_check: false
|
|
disable_failure: true
|
|
##
|
|
## Authentication Backend Provider Configuration
|
|
##
|
|
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
|
##
|
|
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
|
authentication_backend:
|
|
## Disable both the HTML element and the API for reset password functionality
|
|
disable_reset_password: false
|
|
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
|
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
|
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
|
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
|
## See the below documentation for more information.
|
|
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
|
refresh_interval: 5m
|
|
## LDAP backend configuration.
|
|
##
|
|
## This backend allows Authelia to be scaled to more
|
|
## than one instance and therefore is recommended for
|
|
## production.
|
|
ldap:
|
|
## Enable LDAP Backend.
|
|
enabled: false
|
|
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
|
## Acceptable options are as follows:
|
|
## - 'activedirectory' - For Microsoft Active Directory.
|
|
## - 'custom' - For custom specifications of attributes and filters.
|
|
## This currently defaults to 'custom' to maintain existing behaviour.
|
|
##
|
|
## Depending on the option here certain other values in this section have a default value, notably all of the
|
|
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
|
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
|
implementation: activedirectory
|
|
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
|
## Scheme can be ldap or ldaps in the format (port optional).
|
|
url: ldap://openldap.default.svc.cluster.local
|
|
## Connection Timeout.
|
|
timeout: 5s
|
|
## Use StartTLS with the LDAP connection.
|
|
start_tls: false
|
|
tls:
|
|
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
|
server_name: ""
|
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
skip_verify: false
|
|
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
|
minimum_version: TLS1.2
|
|
## The base dn for every LDAP query.
|
|
base_dn: DC=example,DC=com
|
|
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
|
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
|
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
|
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
|
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
|
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
|
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
|
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
|
username_attribute: "uid"
|
|
## An additional dn to define the scope to all users.
|
|
additional_users_dn: OU=Users
|
|
## The users filter used in search queries to find the user profile based on input filled in login form.
|
|
## Various placeholders are available in the user filter:
|
|
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
|
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
## versions, so please don't use it.
|
|
##
|
|
## Recommended settings are as follows:
|
|
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
|
## - OpenLDAP:
|
|
## - (&({username_attribute}={input})(objectClass=person))
|
|
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
|
##
|
|
## To allow sign in both with username and email, one can use a filter like
|
|
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
|
users_filter: ""
|
|
## An additional dn to define the scope of groups.
|
|
additional_groups_dn: OU=Groups
|
|
## The groups filter used in search queries to find the groups of the user.
|
|
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
|
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
|
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
|
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
## versions, so please don't use it.
|
|
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
|
## later version, so please don't use it.
|
|
##
|
|
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
|
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
|
groups_filter: ""
|
|
## The attribute holding the name of the group
|
|
group_name_attribute: "cn"
|
|
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
|
## first one returned by the LDAP server is used.
|
|
mail_attribute: "mail"
|
|
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
|
display_name_attribute: "displayname"
|
|
## The username of the admin user.
|
|
user: CN=admin,DC=example,DC=com
|
|
plain_password: ""
|
|
##
|
|
## File (Authentication Provider)
|
|
##
|
|
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
|
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
|
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
|
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
|
## please read the docs page below:
|
|
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
##
|
|
file:
|
|
enabled: true
|
|
path: /config/users_database.yml
|
|
password:
|
|
algorithm: argon2id
|
|
iterations: 1
|
|
key_length: 32
|
|
salt_length: 16
|
|
memory: 1024
|
|
parallelism: 8
|
|
##
|
|
## Access Control Configuration
|
|
##
|
|
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
##
|
|
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
## to anyone. Otherwise restrictions follow the rules defined.
|
|
##
|
|
## Note: One can use the wildcard * to match any subdomain.
|
|
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
|
##
|
|
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
##
|
|
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
##
|
|
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
##
|
|
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
## 'user:<username>' or 'group:<groupname>'.
|
|
##
|
|
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
##
|
|
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
## is optional and matches any resource if not provided.
|
|
##
|
|
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
access_control:
|
|
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
## resource if there is no policy to be applied to the user.
|
|
default_policy: deny
|
|
networks_access_control: []
|
|
# networks_access_control:
|
|
# - name: private
|
|
# networks:
|
|
# - 10.0.0.0/8
|
|
# - 172.16.0.0/12
|
|
# - 192.168.0.0/16
|
|
# - name: vpn
|
|
# networks:
|
|
# - 10.9.0.0/16
|
|
|
|
rules: []
|
|
# rules:
|
|
# - domain: public.example.com
|
|
# policy: bypass
|
|
# - domain: "*.example.com"
|
|
# policy: bypass
|
|
# methods:
|
|
# - OPTIONS
|
|
# - domain: secure.example.com
|
|
# policy: one_factor
|
|
# networks:
|
|
# - private
|
|
# - vpn
|
|
# - 192.168.1.0/24
|
|
# - 10.0.0.1
|
|
# - domain:
|
|
# - secure.example.com
|
|
# - private.example.com
|
|
# policy: two_factor
|
|
# - domain: singlefactor.example.com
|
|
# policy: one_factor
|
|
# - domain: "mx2.mail.example.com"
|
|
# subject: "group:admins"
|
|
# policy: deny
|
|
# - domain: "*.example.com"
|
|
# subject:
|
|
# - "group:admins"
|
|
# - "group:moderators"
|
|
# policy: two_factor
|
|
# - domain: dev.example.com
|
|
# resources:
|
|
# - "^/groups/dev/.*$"
|
|
# subject: "group:dev"
|
|
# policy: two_factor
|
|
# - domain: dev.example.com
|
|
# resources:
|
|
# - "^/users/john/.*$"
|
|
# subject:
|
|
# - ["group:dev", "user:john"]
|
|
# - "group:admins"
|
|
# policy: two_factor
|
|
# - domain: "{user}.example.com"
|
|
# policy: bypass
|
|
##
|
|
## Session Provider Configuration
|
|
##
|
|
## The session cookies identify the user once logged in.
|
|
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
|
session:
|
|
## The name of the session cookie. (default: authelia_session).
|
|
name: authelia_session
|
|
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
|
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
|
same_site: lax
|
|
## The time in seconds before the cookie expires and session is reset.
|
|
expiration: 1h
|
|
## The inactivity time in seconds before the session is reset.
|
|
inactivity: 5m
|
|
## The remember me duration.
|
|
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
|
## spy or attack. Currently the default is 1M or 1 month.
|
|
remember_me_duration: 1M
|
|
##
|
|
## Redis Provider
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
##
|
|
## The redis connection details
|
|
redisProvider:
|
|
port: 6379
|
|
## Optional username to be used with authentication.
|
|
# username: authelia
|
|
username: ""
|
|
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
database_index: 0
|
|
## The maximum number of concurrent active connections to Redis.
|
|
maximum_active_connections: 8
|
|
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
minimum_idle_connections: 0
|
|
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
tls:
|
|
enabled: false
|
|
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
server_name: ""
|
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
skip_verify: false
|
|
## Minimum TLS version for the connection.
|
|
minimum_version: TLS1.2
|
|
## The Redis HA configuration options.
|
|
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
high_availability:
|
|
enabled: false
|
|
enabledSecret: false
|
|
## Sentinel Name / Master Name
|
|
sentinel_name: mysentinel
|
|
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
nodes: []
|
|
# nodes:
|
|
# - host: sentinel-0.databases.svc.cluster.local
|
|
# port: 26379
|
|
# - host: sentinel-1.databases.svc.cluster.local
|
|
# port: 26379
|
|
|
|
## Choose the host with the lowest latency.
|
|
route_by_latency: false
|
|
## Choose the host randomly.
|
|
route_randomly: false
|
|
##
|
|
## Regulation Configuration
|
|
##
|
|
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
|
## in a short period of time.
|
|
regulation:
|
|
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
|
max_retries: 3
|
|
## The time range during which the user can attempt login before being banned. The user is banned if the
|
|
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
find_time: 2m
|
|
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
ban_time: 5m
|
|
##
|
|
## Storage Provider Configuration
|
|
##
|
|
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
storage:
|
|
##
|
|
## PostgreSQL (Storage Provider)
|
|
##
|
|
postgres:
|
|
port: 5432
|
|
database: authelia
|
|
username: authelia
|
|
sslmode: disable
|
|
timeout: 5s
|
|
##
|
|
## Notification Provider
|
|
##
|
|
##
|
|
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
|
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
|
notifier:
|
|
## You can disable the notifier startup check by setting this to true.
|
|
disable_startup_check: false
|
|
##
|
|
## File System (Notification Provider)
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
##
|
|
filesystem:
|
|
enabled: true
|
|
filename: /config/notification.txt
|
|
##
|
|
## SMTP (Notification Provider)
|
|
##
|
|
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
|
## [Security] By default Authelia will:
|
|
## - force all SMTP connections over TLS including unauthenticated connections
|
|
## - use the disable_require_tls boolean value to disable this requirement
|
|
## (only works for unauthenticated connections)
|
|
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
|
## (configure in tls section)
|
|
smtp:
|
|
enabled: false
|
|
enabledSecret: false
|
|
host: smtp.mail.svc.cluster.local
|
|
port: 25
|
|
timeout: 5s
|
|
username: test
|
|
plain_password: test
|
|
sender: admin@example.com
|
|
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
|
identifier: localhost
|
|
## Subject configuration of the emails sent.
|
|
## {title} is replaced by the text from the notifier
|
|
subject: "[Authelia] {title}"
|
|
## This address is used during the startup check to verify the email configuration is correct.
|
|
## It's not important what it is except if your email server only allows local delivery.
|
|
startup_check_address: test@authelia.com
|
|
disable_require_tls: false
|
|
disable_html_emails: false
|
|
tls:
|
|
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
server_name: ""
|
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
skip_verify: false
|
|
## Minimum TLS version for either StartTLS or SMTPS.
|
|
minimum_version: TLS1.2
|
|
identity_providers:
|
|
oidc:
|
|
## Enables this in the config map. Currently in beta stage.
|
|
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
enabled: false
|
|
access_token_lifespan: 1h
|
|
authorize_code_lifespan: 1m
|
|
id_token_lifespan: 1h
|
|
refresh_token_lifespan: 90m
|
|
enable_client_debug_messages: false
|
|
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
## security reasons.
|
|
minimum_parameter_entropy: 8
|
|
clients: []
|
|
# clients:
|
|
# -
|
|
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
# id: myapp
|
|
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
# description: My Application
|
|
|
|
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
# secret: apple123
|
|
|
|
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
# public: false
|
|
|
|
## The policy to require for this client; one_factor or two_factor.
|
|
# authorization_policy: two_factor
|
|
|
|
## Configures the consent mode; auto, explicit or implicit
|
|
# consent_mode: auto
|
|
|
|
## Audience this client is allowed to request.
|
|
# audience: []
|
|
|
|
## Scopes this client is allowed to request.
|
|
# scopes:
|
|
# - openid
|
|
# - profile
|
|
# - email
|
|
# - groups
|
|
|
|
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
# redirect_uris:
|
|
# - https://oidc.example.com/oauth2/callback
|
|
|
|
## Grant Types configures which grants this client can obtain.
|
|
## It's not recommended to configure this unless you know what you're doing.
|
|
# grant_types:
|
|
# - refresh_token
|
|
# - authorization_code
|
|
|
|
## Response Types configures which responses this client can be sent.
|
|
## It's not recommended to configure this unless you know what you're doing.
|
|
# response_types:
|
|
# - code
|
|
|
|
## Response Modes configures which response modes this client supports.
|
|
## It's not recommended to configure this unless you know what you're doing.
|
|
# response_modes:
|
|
# - form_post
|
|
# - query
|
|
# - fragment
|
|
|
|
## Client Authentication Method configures which client authentication methods this client supports.
|
|
## It's not recommended to configure this unless you know what you're doing.
|
|
# token_endpoint_auth_method: client_secret_basic
|
|
|
|
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
# userinfo_signing_algorithm: none
|
|
|
|
## This configuration option enforces the use of PKCE for this registered client.
|
|
# require_pkce: false
|
|
|
|
## This setting enforces the use of the specified PKCE challenge method for this individual client.
|
|
# pkce_challange_method: S256
|
|
|
|
portal:
|
|
open:
|
|
enabled: true
|
|
|
|
ingress:
|
|
main:
|
|
required: true
|