53 lines
1.7 KiB
Terraform
53 lines
1.7 KiB
Terraform
|
terraform {
|
||
|
|
required_providers {
|
||
|
|
authentik = {
|
||
|
|
source = "goauthentik/authentik"
|
||
|
|
version = ">= 2023.10.0"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
data "authentik_certificate_key_pair" "default" {
|
||
|
|
name = "authentik Self-signed Certificate"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "authentik_provider_saml" "provider" {
|
||
|
|
name = var.name
|
||
|
|
authorization_flow = var.authorization_flow
|
||
|
|
invalidation_flow = var.invalidation_flow
|
||
|
|
acs_url = var.acs_url
|
||
|
|
issuer = var.issuer
|
||
|
|
audience = var.audience
|
||
|
|
sp_binding = var.sp_binding
|
||
|
|
signing_kp = var.signing_key != null ? var.signing_key : data.authentik_certificate_key_pair.default.id
|
||
|
|
property_mappings = var.property_mappings
|
||
|
|
name_id_mapping = var.name_id_mapping
|
||
|
|
|
||
|
|
assertion_valid_not_before = var.assertion_valid_not_before
|
||
|
|
assertion_valid_not_on_or_after = var.assertion_valid_not_on_or_after
|
||
|
|
session_valid_not_on_or_after = var.session_valid_not_on_or_after
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "authentik_application" "app" {
|
||
|
|
name = var.app_name
|
||
|
|
slug = var.app_slug
|
||
|
|
protocol_provider = authentik_provider_saml.provider.id
|
||
|
|
group = var.app_group
|
||
|
|
policy_engine_mode = var.policy_engine_mode
|
||
|
|
meta_description = var.meta_description
|
||
|
|
meta_launch_url = var.meta_launch_url
|
||
|
|
meta_icon = var.meta_icon
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "authentik_policy_binding" "app_access" {
|
||
|
|
for_each = var.access_policies
|
||
|
|
|
||
|
|
target = authentik_application.app.id
|
||
|
|
policy = each.value.policy_id
|
||
|
|
order = each.value.order
|
||
|
|
|
||
|
|
enabled = lookup(each.value, "enabled", true)
|
||
|
|
timeout = lookup(each.value, "timeout", 30)
|
||
|
|
negate = lookup(each.value, "negate", false)
|
||
|
|
failure_result = lookup(each.value, "failure_result", true)
|
||
|
|
}
|