Adding OIDC for semaphore

group_vars/authelia/vault.yml

@@ -28,3 +28,11 @@ authelia_storage_encryption_key: !vault |
   31656562363863626462323435303937363463616666306432353430346636316632316631626461
   65373433383233323466613064633961393838636238626665343831636239336364363539306665
   35386536653836316366
+authelia_semaphore_oidcsecret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  35343063616134656339623064656131643638386261333563613839336364366539343337616231
+  6236613632383430353566353234303430356333623334360a666236363630646661653733313835
+  61616336323232323462643261633561373130396632623631353361323565356138666663646233
+  3937343935333463350a646631653035636235343032303261346531643339383763636133323365
+  65313838306333333563613533643662393432623137336533386466383431396236613163323962
+  3236323333636131373034633234363939373661663130323338

roles/authelia/templates/configuration.yml.j2

@@ -46,3 +46,29 @@ notifier:
 identity_validation:
   reset_password:
     jwt_secret: {{ authelia_jwt_secret }}
+
+identity_providers:
+  oidc:
+    claims_policies:
+      semaphore_claims_policy:
+        id_token:
+          - groups
+          - email
+          - email_verified
+          - alt_emails
+          - preferred_username
+          - name
+    clients:
+      - client_id: semaphore
+        client_name: Semaphore
+        client_secret: {{ authelia_semaphore_oidcsecret }}
+        claims_policy: semaphore_claims_policy
+        public: false
+        authorization_policy: two_factor
+        redirect_uris:
+          - https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
+        scopes:
+          - openid
+          - profile
+          - email
+        userinfo_signed_response_alg: none