Adding OIDC for semaphore

group_vars/authelia/vault.yml

@@ -27,4 +27,12 @@ authelia_storage_encryption_key: !vault |
   35333766353532373462323631316435363431303963616132663761323039366439636238633731
   31656562363863626462323435303937363463616666306432353430346636316632316631626461
   65373433383233323466613064633961393838636238626665343831636239336364363539306665
-  35386536653836316366
+  35386536653836316366
+authelia_semaphore_oidcsecret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  35343063616134656339623064656131643638386261333563613839336364366539343337616231
+  6236613632383430353566353234303430356333623334360a666236363630646661653733313835
+  61616336323232323462643261633561373130396632623631353361323565356138666663646233
+  3937343935333463350a646631653035636235343032303261346531643339383763636133323365
+  65313838306333333563613533643662393432623137336533386466383431396236613163323962
+  3236323333636131373034633234363939373661663130323338

roles/authelia/templates/configuration.yml.j2

@@ -45,4 +45,30 @@ notifier:
 
 identity_validation:
   reset_password:
-    jwt_secret: {{ authelia_jwt_secret }}
+    jwt_secret: {{ authelia_jwt_secret }}
+
+identity_providers:
+  oidc:
+    claims_policies:
+      semaphore_claims_policy:
+        id_token:
+          - groups
+          - email
+          - email_verified
+          - alt_emails
+          - preferred_username
+          - name
+    clients:
+      - client_id: semaphore
+        client_name: Semaphore
+        client_secret: {{ authelia_semaphore_oidcsecret }}
+        claims_policy: semaphore_claims_policy
+        public: false
+        authorization_policy: two_factor
+        redirect_uris:
+          - https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
+        scopes:
+          - openid
+          - profile
+          - email
+        userinfo_signed_response_alg: none