apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-blueprint-ldap
data:
  ldap.yaml: |
    version: 1
    metadata:
      name: LDAP Provider
    entries:
      - model: authentik_providers_ldap.ldapprovidermapping
        id: ldap-mail-aliases-mapping
        state: present
        identifiers:
          name: "Mail Aliases"
        attrs:
          name: "Mail Aliases"
          expression: |
            return {"mailAlternativeAddress": list(request.user.attributes.get("mailAliases", []))}
      - model: authentik_providers_ldap.ldapprovider
        id: ldap-provider
        state: present
        identifiers:
          name: LDAP
        attrs:
          name: LDAP
          authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          base_dn: "DC=ldap,DC=goauthentik,DC=io"
          bind_mode: cached
          search_mode: cached
          mfa_support: false
          extra_property_mappings:
            - !KeyOf ldap-mail-aliases-mapping
      - model: authentik_core.application
        id: ldap-app
        state: present
        identifiers:
          slug: ldap
        attrs:
          name: LDAP
          slug: ldap
          backchannel_providers:
            - !KeyOf ldap-provider