ebbe.bassandClaude Sonnet 5.5
3c69c2a156
Authorization-code flow with PKCE through an idp adapter (with a fake), ID token validation, identity and roles resolved from the directory with a short cache, refusal of unknown, disabled and locked accounts with one generic page, sessions that end when the account becomes unavailable, sign-out that ends the server-side session, role decorators and the trusted-proxy client address rule. Adds the OIDC_* and PUBLIC_BASE_URL configuration. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
58 lines
2.1 KiB
Bash
58 lines
2.1 KiB
Bash
# Copy to .env and edit. Never commit .env.
|
|
|
|
# Required. At least 32 random characters.
|
|
# Generate: python -c "import secrets; print(secrets.token_urlsafe(64))"
|
|
SECRET_KEY=
|
|
|
|
# Required. Comma-separated host names the portal answers to.
|
|
ALLOWED_HOSTS=portal.example.test
|
|
|
|
# Required. Host name of the directory server; LDAPS (port 636) is always used.
|
|
# Must match a name in the server's certificate. Add :port to use another port.
|
|
LDAP_SERVER=
|
|
|
|
# Required. Distinguished name of the OU whose users the portal may read and change.
|
|
LDAP_USER_OU_DN=
|
|
|
|
# Required. The service account, as a distinguished name or user principal name.
|
|
LDAP_BIND_DN=
|
|
LDAP_BIND_PASSWORD=
|
|
|
|
# Required. Path inside the container of the PEM file with the CA chain that signed the
|
|
# directory server's certificate. Mount the file read-only, for example at /certs/ca.pem.
|
|
LDAP_CA_FILE=/certs/ca.pem
|
|
|
|
# Required for docker compose. Path on the Docker host of the CA chain file; compose mounts it
|
|
# read-only at /certs/ca.pem. (Only compose reads this; the portal does not.)
|
|
CA_FILE_HOST=
|
|
|
|
# Required. Distinguished names of the groups that grant the Publisher and Admin roles.
|
|
LDAP_PUBLISHER_GROUP_DN=
|
|
LDAP_ADMIN_GROUP_DN=
|
|
|
|
# Required. The OpenID provider's application: the issuer address from its OpenID
|
|
# configuration page (keep the trailing slash), client ID and client secret.
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
# Required. The address users reach the portal at (scheme and host only). The sign-in
|
|
# redirect address registered at the provider is this plus /auth/callback.
|
|
PUBLIC_BASE_URL=https://portal.example.test
|
|
|
|
# Optional. Directory for the database. Default /data (the container volume).
|
|
# DATA_DIR=/data
|
|
|
|
# Optional. true or false. Default false. Never true in production.
|
|
# DEBUG=false
|
|
|
|
# Optional. Comma-separated IP addresses or networks of reverse proxies. Default empty.
|
|
# The portal takes the client address from X-Forwarded-For only when the request comes from one of these.
|
|
# TRUSTED_PROXIES=
|
|
|
|
# Optional. DEBUG, INFO, WARNING, ERROR or CRITICAL. Default INFO.
|
|
# LOG_LEVEL=INFO
|
|
|
|
# Optional. IANA time zone used for display. Default Europe/Berlin.
|
|
# DEFAULT_TIMEZONE=Europe/Berlin
|