114 lines
3.0 KiB
Django/Jinja
114 lines
3.0 KiB
Django/Jinja
theme: light
|
|
default_2fa_method: totp
|
|
|
|
server:
|
|
address: 'tcp://0.0.0.0:{{ authelia_port }}'
|
|
|
|
log:
|
|
level: {{ authelia_log_level }}
|
|
|
|
totp:
|
|
issuer: {{ authelia_domain }}
|
|
|
|
authentication_backend:
|
|
file:
|
|
path: /config/users_database.yml
|
|
|
|
access_control:
|
|
default_policy: deny
|
|
rules:
|
|
- domain: "*.{{ authelia_domain }}"
|
|
policy: two_factor
|
|
|
|
session:
|
|
secret: {{ authelia_session_secret }}
|
|
cookies:
|
|
- name: authelia_session
|
|
domain: {{ authelia_domain }}
|
|
authelia_url: "https://auth.{{ authelia_domain }}"
|
|
expiration: 12h
|
|
inactivity: 1h
|
|
|
|
regulation:
|
|
max_retries: 3
|
|
find_time: 2m
|
|
ban_time: 5m
|
|
|
|
storage:
|
|
encryption_key: {{ authelia_storage_encryption_key }}
|
|
local:
|
|
path: /config/db.sqlite3
|
|
|
|
notifier:
|
|
filesystem:
|
|
filename: /config/notification.txt
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
jwt_secret: {{ authelia_jwt_secret }}
|
|
|
|
identity_providers:
|
|
oidc:
|
|
jwks:
|
|
- key_id: 'main-signing-key'
|
|
algorithm: 'RS256'
|
|
use: 'sig'
|
|
key: |
|
|
{{ authelia_jwks_privatekey | b64decode | indent(10) }}
|
|
claims_policies:
|
|
semaphore_claims_policy:
|
|
id_token:
|
|
- groups
|
|
- email
|
|
- email_verified
|
|
- alt_emails
|
|
- preferred_username
|
|
- name
|
|
wikijs_claims_policy:
|
|
id_token:
|
|
- groups
|
|
- email
|
|
- email_verified
|
|
- alt_emails
|
|
- preferred_username
|
|
- name
|
|
clients:
|
|
- client_id: semaphore
|
|
client_name: Semaphore
|
|
client_secret: {{ authelia_semaphore_oidcsecret }}
|
|
claims_policy: semaphore_claims_policy
|
|
public: false
|
|
authorization_policy: two_factor
|
|
consent_mode: 'pre-configured'
|
|
pre_configured_consent_duration: '12M' # Reask consent for data share 1 year after first login
|
|
redirect_uris:
|
|
- https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
userinfo_signed_response_alg: none
|
|
- client_id: wikijs
|
|
client_name: Wiki
|
|
client_secret: {{ wikijs_client_secret }}
|
|
claims_policy: wikijs_claims_policy
|
|
public: false
|
|
authorization_policy: two_factor
|
|
consent_mode: 'pre-configured'
|
|
pre_configured_consent_duration: '1Y' # Reask consent for data share 1 year after first login
|
|
require_pkce: false
|
|
pkce_challenge_method: ''
|
|
redirect_uris:
|
|
- 'https://wikijs.{{ authelia_domain }}/login/{{ wikijs_uuid }}/callback' # Note this must be copied during step 7 of the Application configuration.
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
response_types:
|
|
- 'code'
|
|
grant_types:
|
|
- 'authorization_code'
|
|
access_token_signed_response_alg: 'none'
|
|
userinfo_signed_response_alg: 'none'
|
|
token_endpoint_auth_method: 'client_secret_post' |