425 lines
18 KiB
Text
425 lines
18 KiB
Text
# Kaboot Authentik Blueprint - PRODUCTION
|
|
# Copy this file to kaboot-setup-production.yaml and update the domain.
|
|
#
|
|
# IMPORTANT: Remove or rename kaboot-setup.yaml when using this file
|
|
# to avoid conflicting configurations.
|
|
#
|
|
# Prerequisites:
|
|
# - Set AUTHENTIK_BOOTSTRAP_PASSWORD and AUTHENTIK_BOOTSTRAP_TOKEN in .env
|
|
# - Mount this directory to /blueprints/custom in docker-compose.yml
|
|
# - Update KABOOT_DOMAIN and AUTH_DOMAIN below with your actual domains
|
|
#
|
|
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
|
|
---
|
|
version: 1
|
|
metadata:
|
|
name: Kaboot Application Setup (Production)
|
|
labels:
|
|
blueprints.goauthentik.io/description: "Complete Kaboot OAuth2/OIDC setup for production"
|
|
|
|
context:
|
|
kaboot_domain: kaboot.example.com
|
|
auth_domain: auth.example.com
|
|
|
|
entries:
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# CUSTOM INVALIDATION FLOW (must be defined before brand that references it)
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: kaboot-logout-stage
|
|
model: authentik_stages_user_logout.userlogoutstage
|
|
identifiers:
|
|
name: kaboot-logout
|
|
attrs:
|
|
name: kaboot-logout
|
|
|
|
- id: kaboot-redirect-stage
|
|
model: authentik_stages_redirect.redirectstage
|
|
identifiers:
|
|
name: kaboot-redirect-to-app
|
|
attrs:
|
|
name: kaboot-redirect-to-app
|
|
mode: static
|
|
target_static: !Format ["https://%s", !Context kaboot_domain]
|
|
|
|
- id: kaboot-invalidation-flow
|
|
model: authentik_flows.flow
|
|
identifiers:
|
|
slug: kaboot-invalidation-flow
|
|
attrs:
|
|
name: Kaboot Logout Flow
|
|
title: Logging out...
|
|
slug: kaboot-invalidation-flow
|
|
designation: invalidation
|
|
authentication: none
|
|
background: /media/branding/background.svg
|
|
|
|
- id: kaboot-invalidation-logout-binding
|
|
model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf kaboot-invalidation-flow
|
|
stage: !KeyOf kaboot-logout-stage
|
|
attrs:
|
|
order: 0
|
|
evaluate_on_plan: true
|
|
re_evaluate_policies: false
|
|
|
|
- id: kaboot-invalidation-redirect-binding
|
|
model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf kaboot-invalidation-flow
|
|
stage: !KeyOf kaboot-redirect-stage
|
|
attrs:
|
|
order: 10
|
|
evaluate_on_plan: true
|
|
re_evaluate_policies: false
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# FLOW BACKGROUNDS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: update-authentication-flow-background
|
|
model: authentik_flows.flow
|
|
identifiers:
|
|
slug: default-authentication-flow
|
|
attrs:
|
|
title: Welcome to Kaboot!
|
|
background: /media/branding/background.svg
|
|
|
|
- id: update-authorization-flow-background
|
|
model: authentik_flows.flow
|
|
identifiers:
|
|
slug: default-provider-authorization-implicit-consent
|
|
attrs:
|
|
background: /media/branding/background.svg
|
|
|
|
# NOTE: enrollment-flow background is set in the ENROLLMENT FLOW section below
|
|
# (cannot update a flow before it's created)
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# GROUPS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: kaboot-users-group
|
|
model: authentik_core.group
|
|
identifiers:
|
|
name: kaboot-users
|
|
attrs:
|
|
name: kaboot-users
|
|
|
|
- id: kaboot-ai-access-group
|
|
model: authentik_core.group
|
|
identifiers:
|
|
name: kaboot-ai-access
|
|
attrs:
|
|
name: kaboot-ai-access
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# GROUPS SCOPE MAPPING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: groups-scope-mapping
|
|
model: authentik_providers_oauth2.scopemapping
|
|
identifiers:
|
|
managed: goauthentik.io/providers/oauth2/scope-kaboot-groups
|
|
attrs:
|
|
name: "Kaboot Groups Scope"
|
|
scope_name: groups
|
|
description: "Include user groups in the token"
|
|
expression: |
|
|
return [group.name for group in user.ak_groups.all()]
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# OAUTH2/OIDC PROVIDER
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: kaboot-oauth2-provider
|
|
model: authentik_providers_oauth2.oauth2provider
|
|
identifiers:
|
|
name: Kaboot OAuth2
|
|
attrs:
|
|
name: Kaboot OAuth2
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
invalidation_flow: !KeyOf kaboot-invalidation-flow
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Internal JWT Certificate]]
|
|
client_type: public
|
|
client_id: kaboot-spa
|
|
redirect_uris:
|
|
- url: !Format ["https://%s/callback", !Context kaboot_domain]
|
|
matching_mode: strict
|
|
- url: !Format ["https://%s/silent-renew.html", !Context kaboot_domain]
|
|
matching_mode: strict
|
|
- url: !Format ["https://%s", !Context kaboot_domain]
|
|
matching_mode: strict
|
|
access_code_validity: minutes=1
|
|
access_token_validity: minutes=30
|
|
refresh_token_validity: days=30
|
|
sub_mode: hashed_user_id
|
|
include_claims_in_id_token: true
|
|
issuer_mode: per_provider
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
|
|
- !KeyOf groups-scope-mapping
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# APPLICATION
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: kaboot-application
|
|
model: authentik_core.application
|
|
identifiers:
|
|
slug: kaboot
|
|
attrs:
|
|
name: Kaboot
|
|
slug: kaboot
|
|
provider: !KeyOf kaboot-oauth2-provider
|
|
policy_engine_mode: any
|
|
meta_launch_url: !Format ["https://%s", !Context kaboot_domain]
|
|
|
|
- id: kaboot-group-policy-binding
|
|
model: authentik_policies.policybinding
|
|
identifiers:
|
|
target: !KeyOf kaboot-application
|
|
group: !KeyOf kaboot-users-group
|
|
attrs:
|
|
order: 0
|
|
enabled: true
|
|
negate: false
|
|
timeout: 30
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# BRANDING (must be after application is created)
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: kaboot-brand
|
|
model: authentik_brands.brand
|
|
identifiers:
|
|
domain: !Context auth_domain
|
|
attrs:
|
|
domain: !Context auth_domain
|
|
default: false
|
|
branding_title: Kaboot
|
|
branding_logo: /media/branding/logo.svg
|
|
branding_favicon: /media/branding/logo.svg
|
|
flow_authentication: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
|
flow_invalidation: !KeyOf kaboot-invalidation-flow
|
|
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
|
default_application: !KeyOf kaboot-application
|
|
attributes:
|
|
settings:
|
|
theme:
|
|
base: light
|
|
css: |
|
|
:root {
|
|
--ak-accent: #2563eb;
|
|
--ak-primary: #2563eb;
|
|
--ak-primary-dark: #1e40af;
|
|
--ak-primary-light: #60a5fa;
|
|
--ak-error: #ef4444;
|
|
--ak-success: #22c55e;
|
|
--pf-global--FontFamily--sans-serif: "Inter", system-ui, -apple-system, sans-serif;
|
|
}
|
|
body {
|
|
background-color: #2563eb !important;
|
|
}
|
|
.pf-c-login__main {
|
|
background-color: #ffffff !important;
|
|
border-radius: 2rem !important;
|
|
box-shadow: 0 10px 0 rgba(0,0,0,0.1) !important;
|
|
padding: 3rem !important;
|
|
max-width: 500px !important;
|
|
margin: 0 auto;
|
|
}
|
|
.pf-c-form-control {
|
|
border: 2px solid #e5e7eb !important;
|
|
border-radius: 1rem !important;
|
|
padding: 0.75rem 1rem !important;
|
|
font-weight: 600 !important;
|
|
color: #333 !important;
|
|
font-size: 1rem !important;
|
|
box-shadow: none !important;
|
|
transition: all 0.2s ease !important;
|
|
}
|
|
.pf-c-form-control:focus {
|
|
border-color: #2563eb !important;
|
|
outline: none !important;
|
|
}
|
|
.pf-c-button.pf-m-primary {
|
|
background-color: #333333 !important;
|
|
color: #ffffff !important;
|
|
border: none !important;
|
|
border-radius: 1rem !important;
|
|
padding: 0.75rem 1.5rem !important;
|
|
font-weight: 800 !important;
|
|
font-size: 1.1rem !important;
|
|
box-shadow: 0 6px 0 #000000 !important;
|
|
transform: translateY(0) !important;
|
|
transition: all 0.1s ease !important;
|
|
text-transform: uppercase !important;
|
|
letter-spacing: 0.05em !important;
|
|
}
|
|
.pf-c-button.pf-m-primary:hover {
|
|
background-color: #1a1a1a !important;
|
|
}
|
|
.pf-c-button.pf-m-primary:active {
|
|
transform: translateY(6px) !important;
|
|
box-shadow: none !important;
|
|
}
|
|
.pf-c-button.pf-m-secondary, .pf-c-button.pf-m-link {
|
|
color: #2563eb !important;
|
|
font-weight: 600 !important;
|
|
}
|
|
.pf-c-title {
|
|
font-weight: 900 !important;
|
|
color: #111827 !important;
|
|
text-align: center !important;
|
|
margin-bottom: 1.5rem !important;
|
|
}
|
|
.pf-c-brand {
|
|
filter: drop-shadow(0 4px 6px rgba(0,0,0,0.1));
|
|
}
|
|
.pf-c-alert {
|
|
border-radius: 1rem !important;
|
|
border: 2px solid transparent !important;
|
|
box-shadow: 0 4px 0 rgba(0,0,0,0.05) !important;
|
|
}
|
|
.pf-c-alert.pf-m-danger {
|
|
background-color: #fef2f2 !important;
|
|
border-color: #fca5a5 !important;
|
|
color: #991b1b !important;
|
|
}
|
|
.pf-c-login__main-footer-links-item-link {
|
|
color: #6b7280 !important;
|
|
font-weight: 500 !important;
|
|
}
|
|
.pf-c-background-image {
|
|
display: none !important;
|
|
}
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# PASSWORD POLICY
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: password-complexity-policy
|
|
model: authentik_policies_password.passwordpolicy
|
|
identifiers:
|
|
name: password-complexity
|
|
attrs:
|
|
name: password-complexity
|
|
password_field: password
|
|
length_min: 8
|
|
amount_uppercase: 1
|
|
amount_lowercase: 1
|
|
amount_digits: 1
|
|
error_message: "Password must be at least 8 characters with 1 uppercase, 1 lowercase, and 1 digit."
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# ENROLLMENT STAGES
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: enrollment-prompt-stage
|
|
model: authentik_stages_prompt.promptstage
|
|
identifiers:
|
|
name: enrollment-prompt
|
|
attrs:
|
|
name: enrollment-prompt
|
|
fields:
|
|
- !Find [authentik_stages_prompt.prompt, [name, default-source-enrollment-field-username]]
|
|
- !Find [authentik_stages_prompt.prompt, [name, default-user-settings-field-email]]
|
|
- !Find [authentik_stages_prompt.prompt, [name, default-password-change-field-password]]
|
|
- !Find [authentik_stages_prompt.prompt, [name, default-password-change-field-password-repeat]]
|
|
validation_policies:
|
|
- !KeyOf password-complexity-policy
|
|
|
|
- id: enrollment-user-write-stage
|
|
model: authentik_stages_user_write.userwritestage
|
|
identifiers:
|
|
name: enrollment-user-write
|
|
attrs:
|
|
name: enrollment-user-write
|
|
user_creation_mode: always_create
|
|
create_users_as_inactive: false
|
|
create_users_group: !KeyOf kaboot-users-group
|
|
user_type: internal
|
|
|
|
- id: enrollment-user-login-stage
|
|
model: authentik_stages_user_login.userloginstage
|
|
identifiers:
|
|
name: enrollment-user-login
|
|
attrs:
|
|
name: enrollment-user-login
|
|
session_duration: hours=24
|
|
remember_me_offset: days=30
|
|
network_binding: no_binding
|
|
geoip_binding: no_binding
|
|
terminate_other_sessions: false
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# ENROLLMENT FLOW
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: enrollment-flow
|
|
model: authentik_flows.flow
|
|
identifiers:
|
|
slug: enrollment-flow
|
|
attrs:
|
|
name: Enrollment Flow
|
|
title: Sign Up
|
|
slug: enrollment-flow
|
|
designation: enrollment
|
|
authentication: none
|
|
background: /media/branding/background.svg
|
|
|
|
- id: enrollment-flow-prompt-binding
|
|
model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-prompt-stage
|
|
attrs:
|
|
order: 10
|
|
evaluate_on_plan: true
|
|
re_evaluate_policies: false
|
|
invalid_response_action: retry
|
|
|
|
- id: enrollment-flow-user-write-binding
|
|
model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-user-write-stage
|
|
attrs:
|
|
order: 20
|
|
evaluate_on_plan: true
|
|
re_evaluate_policies: false
|
|
invalid_response_action: retry
|
|
|
|
- id: enrollment-flow-user-login-binding
|
|
model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-user-login-stage
|
|
attrs:
|
|
order: 30
|
|
evaluate_on_plan: true
|
|
re_evaluate_policies: false
|
|
invalid_response_action: retry
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# LINK ENROLLMENT FLOW TO DEFAULT LOGIN
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
- id: update-identification-stage
|
|
model: authentik_stages_identification.identificationstage
|
|
identifiers:
|
|
name: default-authentication-identification
|
|
attrs:
|
|
enrollment_flow: !KeyOf enrollment-flow
|
|
user_fields:
|
|
- email
|
|
- username
|
|
case_insensitive_matching: true
|
|
show_matched_user: true
|
|
show_source_labels: false
|
|
pretend_user_exists: true
|