159 lines
4.8 KiB
Nix
159 lines
4.8 KiB
Nix
{ config, ... }:
|
|
|
|
let
|
|
host = "saml-idp.dgnum.eu";
|
|
in
|
|
{
|
|
|
|
imports = [ ./module.nix ];
|
|
|
|
services.satosa = {
|
|
enable = true;
|
|
|
|
inherit host;
|
|
port = 8090;
|
|
|
|
envFile = config.age.secrets."satosa-env_file".path;
|
|
|
|
frontendModules = {
|
|
saml2IDP = {
|
|
module = "satosa.frontends.saml2.SAMLFrontend";
|
|
name = "Saml2IDP";
|
|
config = {
|
|
endpoints.single_sign_on_service = {
|
|
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" = "sso/post";
|
|
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" = "sso/redirect";
|
|
};
|
|
entityid_endpoint = true;
|
|
enable_metadata_reload = false;
|
|
idp_config = {
|
|
organization = {
|
|
display_name = "Délégation Générale Numérique";
|
|
name = "DGNum";
|
|
url = "https://dgnum.eu";
|
|
};
|
|
|
|
contact_person = [
|
|
{
|
|
contact_type = "technical";
|
|
email_address = "mailto:tom.hubrecht@dgnum.eu";
|
|
given_name = "Tom Hubrecht";
|
|
}
|
|
];
|
|
|
|
key_file = "/var/lib/satosa/ssl/key.pem";
|
|
cert_file = "/var/lib/satosa/ssl/cert.pem";
|
|
|
|
metadata.local = [ ];
|
|
|
|
entityid = "https://${host}/Saml2IDP";
|
|
accepted_time_diff = 60;
|
|
service = {
|
|
idp = {
|
|
endpoints.single_sign_on_service = [ ];
|
|
name = "DGNum proxy IdP";
|
|
ui_info = {
|
|
display_name = [
|
|
{
|
|
lang = "fr";
|
|
text = "Service de connexion DGNum";
|
|
}
|
|
];
|
|
};
|
|
name_id_format = [
|
|
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
|
|
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
|
|
];
|
|
policy = {
|
|
default = {
|
|
attribute_restrictions = null;
|
|
fail_on_missing_requested = false;
|
|
lifetime = {
|
|
minutes = 15;
|
|
};
|
|
name_form = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri";
|
|
encrypt_assertion = false;
|
|
encrypted_advice_attributes = false;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
backendModules = {
|
|
# module: satosa.backends.openid_connect.OpenIDConnectBackend
|
|
# name: openid_connect
|
|
# config:
|
|
# provider_metadata:
|
|
# issuer: https://op.example.com
|
|
# client:
|
|
# verify_ssl: yes
|
|
# auth_req_params:
|
|
# response_type: code
|
|
# scope: [openid, profile, email, address, phone]
|
|
# client_metadata:
|
|
# application_name: SATOSA
|
|
# application_type: web
|
|
# contacts: [ops@example.com]
|
|
# redirect_uris: [<base_url>/<name>]
|
|
# subject_type: public
|
|
# entity_info:
|
|
# contact_person:
|
|
# - contact_type: "technical"
|
|
# email_address: ["technical_test@example.com", "support_test@example.com"]
|
|
# given_name: "Test"
|
|
# sur_name: "OP"
|
|
# - contact_type: "support"
|
|
# email_address: ["support_test@example.com"]
|
|
# given_name: "Support_test"
|
|
# organization:
|
|
# display_name:
|
|
# - ["OP Identities", "en"]
|
|
# name:
|
|
# - ["En test-OP", "se"]
|
|
# - ["A test OP", "en"]
|
|
# url:
|
|
# - ["http://www.example.com", "en"]
|
|
# - ["http://www.example.se", "se"]
|
|
# ui_info:
|
|
# description:
|
|
# - ["This is a test OP", "en"]
|
|
# display_name:
|
|
# - ["OP - TEST", "en"]
|
|
kanidm = {
|
|
module = "satosa.backends.openid_connect.OpenIDConnectBackend";
|
|
name = "kanidm";
|
|
config = {
|
|
provider_metadata.issuer = "https://sso.dgnum.eu/oauth2/openid/satosa_dgn/";
|
|
client = {
|
|
auth_req_params = {
|
|
response_type = "code";
|
|
scope = [
|
|
"openid"
|
|
"profile"
|
|
"email"
|
|
];
|
|
};
|
|
client_metadata = {
|
|
client_id = "satosa_dgn";
|
|
client_secret = "ENV! SATOSA_FRONTEND_KANIDM_CLIENT_SECRET";
|
|
redirect_uris = [ "https://${host}/kanidm" ];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts.${host} = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
};
|
|
|
|
age-secrets.matches."^satosa-.*$" = {
|
|
owner = "satosa";
|
|
};
|
|
}
|