backend/config/auth.config.js
2020-03-01 15:37:52 -06:00

179 lines
7.0 KiB
JavaScript

const auth_config = {
default_provider: env('AUTH_DEFAULT_PROVIDER', 'flitter'),
default_login_route: '/dash',
servers: {
// OAuth2 authorization server
oauth2: {
enable: env('OAUTH2_SERVER_ENABLE', false),
// Grants that are available to clients. Supported types are authorization_code, password
grants: ['authorization_code'],
// Built in data retrieval endpoints. These are protected by user-specific OAuth2 tokens
built_in_endpoints: {
// Get the token user's data
user: {
// enable: env('OAUTH2_SERVER_ENABLE', true),
enable: false,
// Fields to return to the endpoint
// The keys are the keys in the request. The values are the keys in the user.
fields: {
username: 'uid',
id: 'uuid',
// Data is a special key. It's key-value pairs are included,
// unserialized, from the user's JSON data.
data: {
// Fields stored in serialized data can be included here:
// special_field: 'some_json_data_field',
},
},
},
},
},
},
// Auth provider configurations
// You can have multiple of the same 'type' of auth source, but they
// must have unique names. The name is the key of the source config.
// Valid types are (by default): FlitterProvider, LdapProvider, Oauth2Provider
sources: {
// Default, database-backed auth provider
flitter: {
type: 'FlitterProvider',
enable: env('AUTH_FLITTER_ENABLE', false),
registration: env('AUTH_FLITTER_REGISTRATION', true),
min_password_length: env('AUTH_MIN_PASSWORD_LENGTH', 8),
},
// LDAP-backed auth provider
example_ldap: {
type: 'LdapProvider',
enable: env('AUTH_LDAP_ENABLE', false),
host: env('AUTH_LDAP_HOST', 'localhost'),
port: env('AUTH_LDAP_PORT', 389),
secure: env('AUTH_LDAP_BIND_SECURE', false),
bind_dn: env('AUTH_LDAP_BIND_DN', 'uid=auth_agent,ou=people,dc=domain,dc=local'),
bind_secret: env('AUTH_LDAP_BIND_PW'),
user_search_base: env('AUTH_LDAP_SEARCH_BASE', 'ou=people,dc=domain,dc=local'),
user_filter: env('AUTH_LDAP_USER_FILTER', '(uid=%u)'), // %u is the login provided username
min_password_length: env('AUTH_MIN_PASSWORD_LENGTH', 8),
// Maps flitter-auth roles to LDAP groups
role_groups: {
// Should correspond to existing auth roles
// role_name: 'cn=somegroup,ou=groups,dc=domain,dc=local',
},
// Maps user attributes to LDAP data attributes
attributes: {
uid: env('AUTH_LDAP_ATTR_UID', 'uid'),
first_name: env('AUTH_LDAP_ATTR_FIRST_NAME', 'cn'),
last_name: env('AUTH_LDAP_ATTR_LAST_NAME', 'sn'),
email: env('AUTH_LDAP_ATTR_EMAIL', 'mail'),
// Special case - used to determine group memberships
group_membership: env('AUTH_LDAP_ATTR_GROUPS', 'memberOf'),
},
registration: env('AUTH_LDAP_REGISTRATION', false),
// Default attributes for new registered users
// %u can be used to interpolate the registered user's uid
registration_merge_attributes: {
objectClass: ['posixAccount', 'shadowAccount', 'inetOrgPerson'],
sn: '%u',
cn: '%u',
gecos: '%u',
uidNumber: -1,
gidNumber: -1,
homeDirectory: '/dev/null',
},
},
github_oauth: {
type: 'Oauth2Provider',
enable: env('AUTH_OAUTH2_ENABLE', true),
source_name: env('AUTH_OAUTH2_SOURCE_NAME', 'GitHub'),
source_client_id: env('AUTH_OAUTH2_CLIENT_ID'),
source_client_secret: env('AUTH_OAUTH2_CLIENT_SECRET'),
// Login page destination where the user will be redirected to on login
// %c will be interpolated with the client id
// %r will be interpolated with the redirect callback url
// NOTE: This url is the same as the login page - /auth/oauth2/login
source_login_page: env('AUTH_OAUTH2_LOGIN_REDIRECT', 'https://github.com/login/oauth/authorize?client_id=%c'),
// Information about the OAuth2 Callback
callback: {
// URL query parameter name with the authorization_code token
// e.g. ?code=XXXXXXXXXX
token_key: 'code',
},
// Information about the endpoint flitter-auth will use to redeem
// the authorization_code token for a bearer token
source_token: {
endpoint: 'https://github.com/login/oauth/access_token',
// Field name where the authorization_code token will be specified in the request
token_key: 'code',
// Field name for the client id
client_id_key: 'client_id',
// Field name for the client secret
client_secret_key: 'client_secret',
// Field name for the grant_type ('authorization_type')
grant_type_key: 'grant_type',
// Field name where the bearer token will be specified in the response
response_token_key: 'access_token',
},
// Information about the endpoint flitter-auth will use to get
// user information after it retrieves a bearer token
user_data: {
endpoint: 'https://api.github.com/user',
method: 'get', // 'get' or 'post' only
// In the response data, what key is the user data in?
// e.g. if 'data', then {'data': { ... }}
// Set falsy to assume the data exists in the root: { ... }
// data_root: 'data',
// Value that prefixes the token in the 'Authorization: ' header.
// e.g. 'token ' would mean 'token a0fw93ja0w93ja093wj'
// 'Bearer ' would be 'Bearer 0329j0239dj209j3209jd'
token_prefix: 'token ',
// Mapping of user model attributes to OAuth2 return data from the endpoint
// Note that uuid is not allowed, and uid is required
attributes: {
uid: 'login',
},
},
},
},
roles: {
// Roles can be defined here as arrays of permissions:
// 'role_name': [ 'permission1', 'permission2' ],
// Then, users with that role will automatically inherit the permissions.
},
}
module.exports = auth_config