lhahnandClaude Opus 5.5
0417ecd9a1
- SSO_* settings (login only, master password still decrypts the vault) - optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts - blueprints are copied into the authentik container, it only applies files from /blueprints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
2.2 KiB
Django/Jinja
53 lines
2.2 KiB
Django/Jinja
# managed by ansible (cloud-vaultwarden); applied with `ak apply_blueprint`
|
|
version: 1
|
|
metadata:
|
|
name: "{{ vaultwarden_sso_name }} SSO"
|
|
entries:
|
|
# vaultwarden only links an SSO login to an existing account for verified addresses
|
|
- model: authentik_providers_oauth2.scopemapping
|
|
id: email-verified
|
|
identifiers:
|
|
name: "{{ vaultwarden_sso_name }} OpenID 'email' (verified)"
|
|
attrs:
|
|
scope_name: email
|
|
description: Email address (verified)
|
|
expression: |
|
|
return {
|
|
"email": request.user.email,
|
|
"email_verified": True,
|
|
}
|
|
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: provider
|
|
identifiers:
|
|
name: "{{ vaultwarden_sso_name }}"
|
|
attrs:
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_authorization_flow }}]]
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_invalidation_flow }}]]
|
|
client_type: confidential
|
|
# newer authentik versions only allow explicitly listed grant types
|
|
grant_types:
|
|
- authorization_code
|
|
- refresh_token
|
|
client_id: "{{ vaultwarden_sso_client_id }}"
|
|
client_secret: "{{ vaultwarden_sso_client_secret }}"
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: "https://{{ vaultwarden_domain }}/identity/connect/oidc-signin"
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "{{ vaultwarden_sso_authentik_signing_key }}"]]
|
|
sub_mode: hashed_user_id
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
|
- !KeyOf email-verified
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-offline_access]]
|
|
|
|
- model: authentik_core.application
|
|
identifiers:
|
|
slug: "{{ vaultwarden_sso_slug }}"
|
|
attrs:
|
|
name: "{{ vaultwarden_sso_name }}"
|
|
provider: !KeyOf provider
|
|
meta_launch_url: "https://{{ vaultwarden_domain }}/"
|
|
policy_engine_mode: any
|