24 lines
1.0 KiB
Bash
24 lines
1.0 KiB
Bash
# Copy to /opt/casan-control-panel/oauth2-proxy.env on the host.
|
|
# Values below are placeholders; do not commit real secrets.
|
|
|
|
OAUTH2_PROXY_PROVIDER=oidc
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL=https://idp.example.com/realms/casan
|
|
OAUTH2_PROXY_CLIENT_ID=casan-control-panel
|
|
OAUTH2_PROXY_CLIENT_SECRET=replace-with-secret
|
|
OAUTH2_PROXY_COOKIE_SECRET=replace-with-32-byte-base64-secret
|
|
OAUTH2_PROXY_COOKIE_SECURE=true
|
|
OAUTH2_PROXY_EMAIL_DOMAINS=*
|
|
OAUTH2_PROXY_SCOPE=openid email profile groups
|
|
OAUTH2_PROXY_OIDC_GROUPS_CLAIM=groups
|
|
OAUTH2_PROXY_REDIRECT_URL=https://control-panel.example.com/oauth2/callback
|
|
|
|
# Required so nginx can pass verified identity to the API.
|
|
OAUTH2_PROXY_SET_XAUTHREQUEST=true
|
|
OAUTH2_PROXY_PASS_ACCESS_TOKEN=false
|
|
OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=false
|
|
|
|
# Recommended: restrict to groups that map through rbac-check.py map-claim:
|
|
# casan-org-admin, casan-project-admin, casan-approver, casan-operator,
|
|
# casan-viewer, casan-auditor.
|
|
# OAUTH2_PROXY_ALLOWED_GROUPS=casan-org-admin,casan-project-admin,casan-approver,casan-operator,casan-viewer,casan-auditor
|