auth deploy

config/auth.config.js

@@ -0,0 +1,177 @@
+const auth_config = {
+
+    default_provider: env('AUTH_DEFAULT_PROVIDER', 'flitter'),
+    default_login_route: '/dash',
+
+    servers: {
+        // OAuth2 authorization server
+        oauth2: {
+            enable: env('OAUTH2_SERVER_ENABLE', false),
+
+            // Grants that are available to clients. Supported types are authorization_code, password
+            grants: ['authorization_code'],
+
+            // Built in data retrieval endpoints. These are protected by user-specific OAuth2 tokens
+            built_in_endpoints: {
+
+                // Get the token user's data
+                user: {
+                    enable: env('OAUTH2_SERVER_ENABLE', true),
+
+                    // Fields to return to the endpoint
+                    // The keys are the keys in the request. The values are the keys in the user.
+                    fields: {
+                        username: 'uid',
+                        id: 'uuid',
+
+                        // Data is a special key. It's key-value pairs are included,
+                        // unserialized, from the user's JSON data.
+                        data: {
+                            // Fields stored in serialized data can be included here:
+                            // special_field: 'some_json_data_field',
+                        },
+                    },
+                },
+            },
+        },
+    },
+
+    // Auth provider configurations
+    // You can have multiple of the same 'type' of auth source, but they
+    // must have unique names. The name is the key of the source config.
+    // Valid types are (by default): FlitterProvider, LdapProvider, Oauth2Provider
+    sources: {
+        // Default, database-backed auth provider
+        flitter: {
+            type: 'FlitterProvider',
+            enable: env('AUTH_FLITTER_ENABLE', false),
+            registration: env('AUTH_FLITTER_REGISTRATION', true),
+            min_password_length: env('AUTH_MIN_PASSWORD_LENGTH', 8),
+        },
+
+        // LDAP-backed auth provider
+        example_ldap: {
+            type: 'LdapProvider',
+            enable: env('AUTH_LDAP_ENABLE', false),
+
+            host: env('AUTH_LDAP_HOST', 'localhost'),
+            port: env('AUTH_LDAP_PORT', 389),
+            secure: env('AUTH_LDAP_BIND_SECURE', false),
+            bind_dn: env('AUTH_LDAP_BIND_DN', 'uid=auth_agent,ou=people,dc=domain,dc=local'),
+            bind_secret: env('AUTH_LDAP_BIND_PW'),
+
+            user_search_base: env('AUTH_LDAP_SEARCH_BASE', 'ou=people,dc=domain,dc=local'),
+            user_filter: env('AUTH_LDAP_USER_FILTER', '(uid=%u)'), // %u is the login provided username
+
+            min_password_length: env('AUTH_MIN_PASSWORD_LENGTH', 8),
+
+            // Maps flitter-auth roles to LDAP groups
+            role_groups: {
+                // Should correspond to existing auth roles
+                // role_name: 'cn=somegroup,ou=groups,dc=domain,dc=local',
+            },
+
+            // Maps user attributes to LDAP data attributes
+            attributes: {
+                uid: env('AUTH_LDAP_ATTR_UID', 'uid'),
+                first_name: env('AUTH_LDAP_ATTR_FIRST_NAME', 'cn'),
+                last_name: env('AUTH_LDAP_ATTR_LAST_NAME', 'sn'),
+                email: env('AUTH_LDAP_ATTR_EMAIL', 'mail'),
+
+                // Special case - used to determine group memberships
+                group_membership: env('AUTH_LDAP_ATTR_GROUPS', 'memberOf'),
+            },
+
+            registration: env('AUTH_LDAP_REGISTRATION', false),
+
+            // Default attributes for new registered users
+            // %u can be used to interpolate the registered user's uid
+            registration_merge_attributes: {
+                objectClass: ['posixAccount', 'shadowAccount', 'inetOrgPerson'],
+                sn: '%u',
+                cn: '%u',
+                gecos: '%u',
+                uidNumber: -1,
+                gidNumber: -1,
+                homeDirectory: '/dev/null',
+            },
+        },
+
+        example_oauth: {
+            type: 'Oauth2Provider',
+            enable: env('AUTH_OAUTH2_ENABLE', true),
+
+            source_name: env('AUTH_OAUTH2_SOURCE_NAME', 'GitHub'),
+            source_client_id: env('AUTH_OAUTH2_CLIENT_ID'),
+            source_client_secret: env('AUTH_OAUTH2_CLIENT_SECRET'),
+
+            // Login page destination where the user will be redirected to on login
+            // %c will be interpolated with the client id
+            // %r will be interpolated with the redirect callback url
+            //  NOTE: This url is the same as the login page - /auth/oauth2/login
+            source_login_page: env('AUTH_OAUTH2_LOGIN_REDIRECT', 'https://github.com/login/oauth/authorize?client_id=%c'),
+
+            // Information about the OAuth2 Callback
+            callback: {
+                // URL query parameter name with the authorization_code token
+                // e.g. ?code=XXXXXXXXXX
+                token_key: 'code',
+            },
+
+            // Information about the endpoint flitter-auth will use to redeem
+            // the authorization_code token for a bearer token
+            source_token: {
+                endpoint: 'https://github.com/login/oauth/access_token',
+
+                // Field name where the authorization_code token will be specified in the request
+                token_key: 'code',
+
+                // Field name for the client id
+                client_id_key: 'client_id',
+
+                // Field name for the client secret
+                client_secret_key: 'client_secret',
+
+                // Field name for the grant_type ('authorization_type')
+                grant_type_key: 'grant_type',
+
+                // Field name where the bearer token will be specified in the response
+                response_token_key: 'access_token',
+            },
+
+            // Information about the endpoint flitter-auth will use to get
+            // user information after it retrieves a bearer token
+            user_data: {
+                endpoint: 'https://api.github.com/user',
+                method: 'get', // 'get' or 'post' only
+
+                // In the response data, what key is the user data in?
+                // e.g. if 'data', then {'data': { ... }}
+                // Set falsy to assume the data exists in the root: { ... }
+                // data_root: 'data',
+
+                // Value that prefixes the token in the 'Authorization: ' header.
+                // e.g. 'token ' would mean 'token a0fw93ja0w93ja093wj'
+                //      'Bearer ' would be 'Bearer 0329j0239dj209j3209jd'
+                token_prefix: 'token ',
+
+                // Mapping of user model attributes to OAuth2 return data from the endpoint
+                // Note that uuid is not allowed, and uid is required
+                attributes: {
+                    uid: 'login',
+                },
+            },
+        },
+    },
+
+    roles: {
+
+        // Roles can be defined here as arrays of permissions:
+        // 'role_name': [ 'permission1', 'permission2' ],
+        // Then, users with that role will automatically inherit the permissions.
+
+    },
+
+}
+
+module.exports = auth_config