mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
authentik: add an OIDC provider for immich
The Scouting MBG photos (immich) will log in through this authentik, which later passes on Scouts Online. The provider issues immich_role and immich_quota: admins and the members of "MBG kader" may upload (-1), everyone else gets a quota of 0, which makes immich refuse uploads. "MBG leden" and "MBG kader" are filled by the Scouts Online source in a next step; until then only authentik Admins can use the app. The scouting blueprints and their secrets are mounted as directories rather than with subPath, and the blueprint reads the client secret with !File instead of !Env, so later changes reach authentik without a restart.
This commit is contained in:
Ruben Hensen committed
1 parent
278f6fc55f
commit
48b0873ca3
3 files changed
+154
No files matched your search
@@ -127,6 +127,21 @@ spec:
|
||||
- name: blueprint-longhorn
|
||||
configMap:
|
||||
name: authentik-blueprint-longhorn
|
||||
# Directory mounts, not subPath, so changes reach the pods
|
||||
# without a restart. The secrets are optional: a blueprint
|
||||
# that needs a missing one fails until it shows up.
|
||||
- name: blueprint-scouting
|
||||
configMap:
|
||||
name: authentik-blueprint-scouting
|
||||
- name: scouting-secrets
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: immich-oidc-client-secret
|
||||
optional: true
|
||||
items:
|
||||
- key: client_secret
|
||||
path: immich-oidc-client-secret
|
||||
volumeMounts:
|
||||
- name: blueprint-vault
|
||||
mountPath: /blueprints/custom/vault-oidc.yaml
|
||||
@@ -152,6 +167,11 @@ spec:
|
||||
- name: blueprint-longhorn
|
||||
mountPath: /blueprints/custom/longhorn-oidc.yaml
|
||||
subPath: longhorn-oidc.yaml
|
||||
- name: blueprint-scouting
|
||||
mountPath: /blueprints/custom/scouting
|
||||
- name: scouting-secrets
|
||||
mountPath: /secrets/scouting
|
||||
readOnly: true
|
||||
- name: patched-ca-bundle
|
||||
mountPath: /etc/ssl/certs
|
||||
readOnly: true
|
||||
@@ -184,6 +204,21 @@ spec:
|
||||
- name: blueprint-longhorn
|
||||
configMap:
|
||||
name: authentik-blueprint-longhorn
|
||||
# Directory mounts, not subPath, so changes reach the pods
|
||||
# without a restart. The secrets are optional: a blueprint
|
||||
# that needs a missing one fails until it shows up.
|
||||
- name: blueprint-scouting
|
||||
configMap:
|
||||
name: authentik-blueprint-scouting
|
||||
- name: scouting-secrets
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: immich-oidc-client-secret
|
||||
optional: true
|
||||
items:
|
||||
- key: client_secret
|
||||
path: immich-oidc-client-secret
|
||||
volumeMounts:
|
||||
- name: blueprint-vault
|
||||
mountPath: /blueprints/custom/vault-oidc.yaml
|
||||
@@ -209,6 +244,11 @@ spec:
|
||||
- name: blueprint-longhorn
|
||||
mountPath: /blueprints/custom/longhorn-oidc.yaml
|
||||
subPath: longhorn-oidc.yaml
|
||||
- name: blueprint-scouting
|
||||
mountPath: /blueprints/custom/scouting
|
||||
- name: scouting-secrets
|
||||
mountPath: /secrets/scouting
|
||||
readOnly: true
|
||||
- name: patched-ca-bundle
|
||||
mountPath: /etc/ssl/certs
|
||||
readOnly: true
|
||||
|
||||
@@ -0,0 +1,95 @@
|
||||
# Login for the Scouting MBG photos (immich on foto.scoutingmbg.nl).
|
||||
# Mounted as a directory, unlike the other blueprints, so authentik picks up
|
||||
# changes without a restart; secrets come from files in /secrets/scouting
|
||||
# for the same reason (see apps/templates/authentik-helm.yaml).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: authentik-blueprint-scouting
|
||||
data:
|
||||
immich-oidc.yaml: |
|
||||
version: 1
|
||||
metadata:
|
||||
name: immich OIDC
|
||||
entries:
|
||||
# Filled by the Scouts Online source on every login: every member, and
|
||||
# the members with an active Kaderlid role.
|
||||
- model: authentik_core.group
|
||||
id: mbg-leden
|
||||
state: present
|
||||
identifiers:
|
||||
name: MBG leden
|
||||
- model: authentik_core.group
|
||||
id: mbg-kader
|
||||
state: present
|
||||
identifiers:
|
||||
name: MBG kader
|
||||
# immich syncs both claims on every login. A quota of 0 makes immich
|
||||
# refuse uploads, -1 means unlimited.
|
||||
- model: authentik_providers_oauth2.scopemapping
|
||||
id: immich-scope
|
||||
state: present
|
||||
identifiers:
|
||||
name: "immich: role and quota"
|
||||
attrs:
|
||||
name: "immich: role and quota"
|
||||
scope_name: immich
|
||||
description: Upload rights in the Scouting MBG photos
|
||||
expression: |
|
||||
admin = ak_is_group_member(request.user, name="authentik Admins")
|
||||
uploader = admin or ak_is_group_member(request.user, name="MBG kader")
|
||||
return {
|
||||
"immich_role": "admin" if admin else "user",
|
||||
"immich_quota": -1 if uploader else 0,
|
||||
}
|
||||
- model: authentik_providers_oauth2.oauth2provider
|
||||
id: immich-provider
|
||||
state: present
|
||||
identifiers:
|
||||
name: immich
|
||||
attrs:
|
||||
name: immich
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
||||
authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
||||
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
||||
client_type: confidential
|
||||
client_id: immich
|
||||
client_secret: !File /secrets/scouting/immich-oidc-client-secret
|
||||
redirect_uris:
|
||||
- matching_mode: strict
|
||||
url: https://foto.scoutingmbg.nl/auth/login
|
||||
# "Link to OAuth" in immich's account settings
|
||||
- matching_mode: strict
|
||||
url: https://foto.scoutingmbg.nl/user-settings
|
||||
- matching_mode: strict
|
||||
url: app.immich:///oauth-callback
|
||||
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
||||
property_mappings:
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
||||
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
||||
- !KeyOf immich-scope
|
||||
- model: authentik_core.application
|
||||
id: immich-app
|
||||
state: present
|
||||
identifiers:
|
||||
slug: immich
|
||||
attrs:
|
||||
name: Scouting MBG foto's
|
||||
provider: !KeyOf immich-provider
|
||||
meta_launch_url: https://foto.scoutingmbg.nl
|
||||
policy_engine_mode: any
|
||||
- model: authentik_policies.policybinding
|
||||
state: present
|
||||
identifiers:
|
||||
order: 0
|
||||
target: !KeyOf immich-app
|
||||
attrs:
|
||||
group: !KeyOf mbg-leden
|
||||
- model: authentik_policies.policybinding
|
||||
state: present
|
||||
identifiers:
|
||||
order: 1
|
||||
target: !KeyOf immich-app
|
||||
attrs:
|
||||
group: !Find [authentik_core.group, [name, "authentik Admins"]]
|
||||
@@ -153,3 +153,22 @@ spec:
|
||||
remoteRef:
|
||||
key: kv/longhorn-oidc
|
||||
property: client_secret
|
||||
---
|
||||
# Mounted as a file for blueprint-scouting.yaml, not as an env variable.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: immich-oidc-client-secret
|
||||
spec:
|
||||
secretStoreRef:
|
||||
name: vault-backend
|
||||
kind: ClusterSecretStore
|
||||
refreshInterval: 15m
|
||||
target:
|
||||
name: immich-oidc-client-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
remoteRef:
|
||||
key: kv/immich-oidc
|
||||
property: client_secret
|
||||
Reference in new issue
Block a user