Fabre Florian
79208765c9
The previous commit has allowed to run Docs and Find projects stacks together with a tweak : Find must use the keycloak OIDC endpoints of Docs on the 'nginx' domain for ResourceServer authentication and introspection. This configuration broke the OIDC token claims validation because the iss from the token of the 'impress' user is 'localhost' and not 'nginx'. To fix it in deveolopment mode we add a OIDC_RS_VERIFY_CLAIMS setting that controls the token claims validation in FinderResourceServerBackend: - Enabled by default - Forced in production mode Signed-off-by: Fabre Florian <ffabre@hybird.org>
46 lines
1.4 KiB
Plaintext
46 lines
1.4 KiB
Plaintext
# Django
|
|
DJANGO_ALLOWED_HOSTS=*
|
|
DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
|
|
DJANGO_SETTINGS_MODULE=find.settings
|
|
DJANGO_SUPERUSER_PASSWORD=admin
|
|
|
|
# Python
|
|
PYTHONPATH=/app
|
|
|
|
# find settings
|
|
|
|
# Backend url
|
|
FIND_BASE_URL="http://localhost:8072"
|
|
|
|
# Opensearch
|
|
OPENSEARCH_PASSWORD=find.PASS123
|
|
OPENSEARCH_USE_SSL=false
|
|
|
|
# OIDC
|
|
OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/userinfo
|
|
OIDC_OP_URL=http://nginx:8083/realms/impress
|
|
OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token/introspect
|
|
|
|
OIDC_RP_CLIENT_ID=find
|
|
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
|
|
OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
|
|
|
|
# OIDC Resource server
|
|
OIDC_DRF_AUTH_BACKEND="lasuite.oidc_login.backends.OIDCAuthenticationBackend"
|
|
|
|
OIDC_RS_SCOPES="openid"
|
|
OIDC_RS_CLIENT_ID=impress
|
|
OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RS_SIGN_ALGO=RS256
|
|
OIDC_RS_VERIFY_CLAIMS=False
|
|
|
|
OIDC_RS_BACKEND_CLASS="core.authentication.FinderResourceServerBackend"
|
|
OIDC_RS_ENCRYPTION_KEY_TYPE="RSA"
|