User Authentication and External Identity Providers¶

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: ldap
          id: ldap
          name: LDAP
          config:
            ## the LDAP server URL and port
            host: ldap.example.com:636

            ## if we should skip TLS certificate verification
            ## WARNING: this is insecure, prefer to use `rootCAData`
            insecureSkipVerify: false

            ## a base64 encoded PEM file with your root CA certificate
            #rootCAData: ""

            ## the credentials to use for searching the directory
            ## NOTE: not required if anonymous bind is allowed
            #bindDN: uid=Administrator,cn=Users,dc=example,dc=com
            #bindPW: password

            ## text used in password-prompt box
            usernamePrompt: "Username"

            ## how users are searched for, based on the provided username
            userSearch:

              ## base search from
              baseDN: cn=Users,dc=example,dc=com

              ## an additional search filter to apply
              filter: "(objectClass=person)"

              ## how to map user attributes
              username: uid
              idAttr: uid
              emailAttr: mail
              nameAttr: name

            ## how groups are searched for, based on the found user
            groupSearch:
              ## base search from
              baseDN: cn=Groups,dc=example,dc=com

              ## an additional search filter to apply
              ## WARNING: if too many groups are returned, you will exceed the HTTP header size limit.
              ##          you may need to apply a filter like: "(&(objectClass=group)(cn=*deployKF*))" 
              ##          which will only return groups with "deployKF" in the name. However, note that
              ##          deployKF does not currently use these groups, so you are mostly preparing 
              ##          for the future.
              filter: "(objectClass=group)"

              ## list of user-attribute to group-attribute pairs
              ## the value of the found user's `userAttr` must be one of the group's `groupAttr`
              userMatchers:
                - userAttr: uid
                  groupAttr: member

              ## how to map group attributes
              nameAttr: cn

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: oidc
          id: aws-cognito
          name: AWS Cognito
          config:
            issuer: https://cognito-idp.<AWS_REGION>.amazonaws.com/<USER_POOL_ID>

            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the AWS Cognito app
            redirectURI: https://deploykf.example.com/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile

            ## cognito does not send the `name` claim
            userNameKey: cognito:username

            ## cognito does not always send the `email_verified` claim
            insecureSkipEmailVerified: true

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: github
          id: github
          name: GitHub
          config:
            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the GitHub app
            redirectURI: https://deploykf.example.com/dex/callback

            ## a list of GitHub organizations and teams to allow users from
            orgs:
              ## allow ALL users from "my-organization"
              - name: "my-organization"

              ## allow users from "my-organization" who are in the listed teams
              #- name: "my-organization"
              #  teams:
              #    - "red-team"
              #    - "blue-team"

            ## how the team names are formatted
            ##  - If "name", the full team name is used (default)
            ##    EXAMPLE: "Site Reliability Engineers"
            ##  - If "slug", the slug of the team name is used
            ##    EXAMPLE: "site-reliability-engineers"
            teamNameField: slug

            ## how to determine the user's email
            ##  - WARNING: tell users to REMOVE any PUBLIC emails from their 
            ##    GitHub profiles, currently, public emails override this setting.
            ##  - When 'preferredEmailDomain' is set, the first email matching this 
            ##    domain is returned, falling back to the primary email if no match is found.
            ##  - To allow multiple subdomains, you may specify a wildcard like "*.example.com"
            ##    which will match "aaaa.example.com" and "bbbb.example.com", but NOT "example.com".
            #preferredEmailDomain: "example.com"

            ## only required for GitHub Enterprise
            #hostName: github.example.com

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: google
          id: google
          name: Google
          config:
            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the Google app
            redirectURI: https://deploykf.example.com/dex/callback

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: microsoft
          id: microsoft
          name: Microsoft
          config:
            clientID: "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the Okta app
            redirectURI: "https://deploykf.example.com/dex/callback"

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: oidc
          id: okta
          name: Okta
          config:
            issuer: https://MY_COMPANY.okta.com

            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the Okta app
            redirectURI: https://deploykf.example.com/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile
              ## NOTE: offline_access is required for refresh tokens
              ##  - ensure the Okta app has "Refresh Token" grant type enabled
              ##  - set the "Refresh Token Behavior" to "Rotate token after every use"
              - offline_access

            ## okta does not always send the `email_verified` claim
            insecureSkipEmailVerified: true

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: oidc
          id: onelogin
          name: OneLogin
          config:
            issuer: https://openid-connect.onelogin.com/oidc

            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the OneLogin app
            redirectURI: https://deploykf.example.com/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile
              ## NOTE: offline_access is required for refresh tokens
              - offline_access

            ## onelogin does not always send the `email_verified` claim
            insecureSkipEmailVerified: true

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: oidc
          id: keycloak
          name: Keycloak
          config:
            issuer: https://keycloak.example.com/realms/<REALM_NAME>

            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the Keycloak app
            redirectURI: https://deploykf.example.com/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile
              ## NOTE: offline_access is required for refresh tokens
              - offline_access

            ## keycloak does not always send the `email_verified` claim
            insecureSkipEmailVerified: true

            ## if your Keycloak uses a self-signed certificate
            #insecureSkipVerify: true

deploykf_core:
  deploykf_auth:
    dex:
      connectors:
        - type: oidc
          id: oidc
          name: Generic OIDC
          config:
            ## replace with your OIDC provider's issuer URL
            ## NOTE: the URL must expose the `.well-known/openid-configuration` endpoint 
            issuer: https://oidc.example.com

            ## credentials for the OIDC client
            clientID: "XXXXXXXXXXXXXXXXXXXX"
            clientSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the OIDC app
            redirectURI: https://deploykf.example.com/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile
              ## NOTE: offline_access is typically required for refresh tokens
              ##       if possible, configure your provider to only allow each
              ##       refresh token to be used once
              - offline_access

            ## set to true, if provider does not always send `email_verified` claim
            insecureSkipEmailVerified: true