Compare commits
3 Commits
Author | SHA1 | Date |
---|---|---|
knoflook | 915a3e83e7 | |
knoflook | 0c691d8f40 | |
knoflook | 9e087bda4a |
|
@ -10,6 +10,9 @@ SECRET_DB_ROOT_PASSWORD_VERSION=v1
|
|||
SECRET_ADMIN_PASSWORD_VERSION=v1
|
||||
|
||||
# SSO_ENABLED=0
|
||||
## only set one of those depending on which SSO you're using
|
||||
# SSO_AUTHENTIK=1
|
||||
# SSO_KEYCLOAK=0
|
||||
# SSO_PROVIDER_URL=https://sso.example.org/
|
||||
# SSO_SAML_URL=https://sso.example.org/application/saml/<application-slug>/sso/binding/redirect/
|
||||
# SSO_LOGOUT_URL=https://sso.example.org/if/session-end/<application-slug>/
|
||||
|
|
4
abra.sh
4
abra.sh
|
@ -1,7 +1,7 @@
|
|||
export ENTRYPOINT_CONF_VERSION=v1
|
||||
export LOCAL_CONF_VERSION=v1
|
||||
export LOCAL_CONF_VERSION=v3
|
||||
|
||||
create_admin () {
|
||||
export DATABASE_URL="$DATABASE_TYPE://$DATABASE_USER:$(cat /run/secrets/db_password)@$DATABASE_HOST/$DATABASE_NAME"
|
||||
/opt/kimai/bin/console kimai:create-user admin admin@example.org ROLE_SUPER_ADMIN
|
||||
/opt/kimai/bin/console kimai:create-user admin admin@example.org ROLE_SUPER_ADMIN
|
||||
}
|
||||
|
|
|
@ -15,6 +15,8 @@ services:
|
|||
- DATABASE_PASSWORD_FILE=/run/secrets/db_password
|
||||
- DOMAIN
|
||||
- SSO_ENABLED
|
||||
- SSO_KEYCLOAK
|
||||
- SSO_AUTHENTIK
|
||||
- SSO_PROVIDER_URL
|
||||
- SSO_SAML_URL
|
||||
- SSO_LOGOUT_URL
|
||||
|
@ -57,7 +59,7 @@ services:
|
|||
- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
|
||||
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
|
||||
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
|
||||
- "coop-cloud.${STACK_NAME}.version=0.2.0+apache-debian-1.29.1-prod"
|
||||
- "coop-cloud.${STACK_NAME}.version=0.3.0+apache-1.29.1-prod"
|
||||
db:
|
||||
image: mysql:5.7
|
||||
environment:
|
||||
|
|
|
@ -3,14 +3,27 @@ kimai:
|
|||
saml:
|
||||
activate: true
|
||||
title: Login with SAML
|
||||
{{ if eq (env "SSO_AUTHENTIK") "1" }}
|
||||
mapping:
|
||||
- { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, kimai: email }
|
||||
- { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, kimai: alias }
|
||||
roles:
|
||||
attribute: http://schemas.xmlsoap.org/claims/Group
|
||||
resetOnLogin: true
|
||||
attribute: Roles
|
||||
mapping:
|
||||
# Insert your roles here (ROLE_USER is added automatically)
|
||||
- { saml: admin.group, kimai: ROLE_ADMIN }
|
||||
{{ else if eq (env "SSO_KEYCLOAK") "1" }}
|
||||
mapping:
|
||||
- { saml: $Email, kimai: email }
|
||||
- { saml: $FirstName $LastName, kimai: alias }
|
||||
roles:
|
||||
resetOnLogin: true
|
||||
attribute: Roles
|
||||
mapping:
|
||||
- { saml: Admins, kimai: ROLE_ADMIN }
|
||||
- { saml: Management, kimai: ROLE_TEAMLEAD }
|
||||
{{ end }}
|
||||
connection:
|
||||
# You SAML provider
|
||||
# Your Authentik instance, replace https://authentik.company with your authentik URL
|
||||
|
|
|
@ -0,0 +1,5 @@
|
|||
If you have SSO enabled this upgrade will break unless you add
|
||||
`SSO_KEYCLOAK=1` or `SSO_AUTHENTIK=1` in your env file for kimai!
|
||||
This allows us to support both SSO methods
|
||||
|
||||
knoflook @ kotec.pl
|
Loading…
Reference in New Issue