Skip to content

Commit 3b09f8c

Browse files
piotrek-januspiotrek-janus
committed
add advanced example
1 parent 8997576 commit 3b09f8c

File tree

16 files changed

+692
-5
lines changed

16 files changed

+692
-5
lines changed

‎examples/e2e/README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# End-to-end Configuration Example
2+
3+
This example demonstrates how to manage configurations across different environments (development and production) using Cloudentity Configuration as Code (CAC).
4+
5+
## Directory Structure
6+
7+
```
8+
e2e/
9+
├── dev/
10+
│ └── .env # Development environment variables
11+
├── prod/
12+
│ └── .env # Production environment variables
13+
├── config.yaml # Main configuration file with profiles
14+
├── data/ # Production configuration files
15+
│ └── workspaces/
16+
│ └── customer-apps/
17+
└── data-dev/ # Development configuration files
18+
└── workspaces/
19+
└── customer-apps/
20+
```
21+
22+
## Usage
23+
24+
### Pull Configurations
25+
26+
To pull configuration from development environment:
27+
28+
```bash
29+
export $(xargs < dev/.env) && cac pull --config config.yaml --workspace customer-apps --profile dev
30+
```
31+
32+
To pull configuration from production environment:
33+
34+
```bash
35+
export $(xargs < prod/.env) && cac pull --config config.yaml --workspace customer-apps
36+
```
37+
38+
### Compare Environments
39+
40+
To compare development and production configurations:
41+
42+
```bash
43+
export $(xargs < prod/.env) && cac diff --config config.yaml --source dev --target prod --workspace customer-apps
44+
```
45+
46+
### Promote Changes
47+
48+
To promote changes from development to production:
49+
50+
1. Review the differences:
51+
```bash
52+
export $(xargs < prod/.env) && cac diff --config config.yaml --source dev --target prod --workspace customer-apps
53+
```
54+
55+
2. Push the changes to production:
56+
```bash
57+
export $(xargs < prod/.env) && cac push --config config.yaml --workspace customer-apps --method patch
58+
```
59+
60+
## Configuration File Structure
61+
62+
The `config.yaml` file contains profiles for both development and production environments. The default profile is used for production, while the `dev` profile is used for development environment.
63+
64+
Check the main [README.md](../../README.md) for more details about configuration options and available

‎examples/e2e/base/workspaces/customer-apps/clients/OAuth2_Demo_Portal.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
id: customer-apps-demo
2+
application_type: web
3+
application_types:
4+
- server_web
5+
audience:
6+
- customer-apps-demo
7+
authorization_details_types: []
8+
authorization_signed_response_alg: RS256
9+
backchannel_logout_session_required: false
10+
backchannel_user_code_parameter: false
11+
client_id_issued_at: 1758231235
12+
client_name: OAuth2 Demo Portal
13+
client_secret_expires_at: 0
14+
client_status: active
15+
client_type: oauth2
16+
default_acr_values: []
17+
dpop_bound_access_tokens: false
18+
dynamically_registered: false
19+
fdx:
20+
contacts: []
21+
duration_period: 0
22+
duration_type: []
23+
intermediaries: []
24+
lookback_period: 0
25+
registry_references: []
26+
grant_types:
27+
- authorization_code
28+
hashed_rotated_secrets: []
29+
id_token_signed_response_alg: RS256
30+
introspection_endpoint_auth_method: client_secret_basic
31+
jwks:
32+
keys: []
33+
obbr:
34+
webhook_uris: []
35+
post_logout_redirect_uris: []
36+
redirect_uris:
37+
- https://{{ env "TENANT_ID" }}.eu.authz.cloudentity.io/{{ env "TENANT_ID" }}/customer-apps/demo
38+
registration_token:
39+
expires_in: 0
40+
request_object_signing_alg: any
41+
request_uris: []
42+
require_pushed_authorization_requests: false
43+
response_types:
44+
- id_token
45+
- code
46+
- token
47+
revocation_endpoint_auth_method: client_secret_basic
48+
rotated_secrets: []
49+
saml_allowed_attributes: []
50+
saml_metadata:
51+
AdditionalMetadataLocations: []
52+
AttributeAuthorityDescriptors: []
53+
AuthnAuthorityDescriptors: []
54+
CacheDuration: 0
55+
IDPSSODescriptors: []
56+
PDPDescriptors: []
57+
RoleDescriptors: []
58+
SPSSODescriptors: []
59+
ValidUntil: 0001-01-01T00:00:00.000Z
60+
saml_override_attributes: false
61+
saml_signing_hash: sha-256
62+
scopes:
63+
- email
64+
- introspect_tokens
65+
- list_clients_with_access
66+
- manage_consents
67+
- offline_access
68+
- openid
69+
- profile
70+
- revoke_client_access
71+
- revoke_tokens
72+
- view_consents
73+
subject_type: public
74+
system: false
75+
tls_client_certificate_bound_access_tokens: false
76+
token_endpoint_auth_method: client_secret_basic
77+
token_exchange:
78+
actor_claims: []
79+
token_ttls:
80+
access_token_ttl: 1h0m0s
81+
authorization_code_ttl: 10m0s
82+
id_token_ttl: 1h0m0s
83+
refresh_token_ttl: 168h0m0s
84+
trusted: false
85+
use_custom_token_ttls: false
86+
userinfo_signed_response_alg: none

‎examples/e2e/base/workspaces/customer-apps/clients/SAML_Demo_Portal.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
id: customer-apps-saml-demo
2+
application_type: web
3+
application_types:
4+
- server_web
5+
audience:
6+
- customer-apps-saml-demo
7+
authorization_details_types: []
8+
authorization_signed_response_alg: RS256
9+
backchannel_logout_session_required: false
10+
backchannel_user_code_parameter: false
11+
client_name: SAML Demo Portal
12+
client_secret_expires_at: 0
13+
client_status: active
14+
client_type: saml
15+
default_acr_values: []
16+
dpop_bound_access_tokens: false
17+
dynamically_registered: false
18+
fdx:
19+
contacts: []
20+
duration_period: 0
21+
duration_type: []
22+
intermediaries: []
23+
lookback_period: 0
24+
registry_references: []
25+
grant_types:
26+
- authorization_code
27+
hashed_rotated_secrets: []
28+
id_token_signed_response_alg: RS256
29+
introspection_endpoint_auth_method: client_secret_basic
30+
jwks:
31+
keys: []
32+
obbr:
33+
webhook_uris: []
34+
post_logout_redirect_uris: []
35+
registration_token:
36+
expires_in: 0
37+
request_object_signing_alg: any
38+
request_uris: []
39+
require_pushed_authorization_requests: false
40+
revocation_endpoint_auth_method: client_secret_basic
41+
rotated_secrets: []
42+
saml_allowed_attributes: []
43+
saml_metadata:
44+
AdditionalMetadataLocations: []
45+
AttributeAuthorityDescriptors: []
46+
AuthnAuthorityDescriptors: []
47+
CacheDuration: 0
48+
EntityID: https://postmance-dev.eu.authz.cloudentity.io/postmance-dev/customer-apps/saml/demo
49+
IDPSSODescriptors: []
50+
PDPDescriptors: []
51+
RoleDescriptors: []
52+
SPSSODescriptors:
53+
- ArtifactResolutionServices: []
54+
AssertionConsumerServices:
55+
- Binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
56+
Index: 1
57+
IsDefault: false
58+
Location: https://postmance-dev.eu.authz.cloudentity.io/postmance-dev/customer-apps/saml/demo
59+
- Binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact
60+
Index: 2
61+
IsDefault: false
62+
Location: https://postmance-dev.eu.authz.cloudentity.io/postmance-dev/customer-apps/saml/demo
63+
AttributeConsumingServices: []
64+
AuthnRequestsSigned: true
65+
CacheDuration: 0
66+
ContactPeople: []
67+
KeyDescriptors:
68+
- EncryptionMethods:
69+
- Algorithm: "http://www.w3.org/2001/04/xmlenc#aes128-cbc"
70+
- Algorithm: "http://www.w3.org/2001/04/xmlenc#aes192-cbc"
71+
- Algorithm: "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
72+
- Algorithm: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
73+
KeyInfo:
74+
X509Data:
75+
X509Certificates:
76+
- Data: MIIC6jCCAdKgAwIBAgIGAZVrYwqeMA0GCSqGSIb3DQEBCwUAMDYxNDAyBgNVBAMMK09TUkJ1LVJmSVUzZTVaTzZ0TndBSTRLRGRqSG1aSXpIaXY1eDhLaF8yUWMwHhcNMjUwMzA2MTIxNjQ3WhcNMjUxMjMxMTIxNjQ3WjA2MTQwMgYDVQQDDCtPU1JCdS1SZklVM2U1Wk82dE53QUk0S0RkakhtWkl6SGl2NXg4S2hfMlFjMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmFCEjSeg3LDKrI/xWD13jpptxjeaiL1FMc2Xso+2jJa0dJrlN7eErSDpIcGF40BopSJcmb5va6BgjzzFoA7NA9uGfNLnkLAx8Qs81aERhxDuufy8iNqq0B2uqIhN9XCESQLyYNfoe7N26OXLgOgeBUlJOnUo+H27JdIn6TrVlp+tyBQBj5D2MDAzlgVoI3qCTWrTQKGwMGxzkQ0Oeq52WiHu2ONMbN1N7MM7UT1yXDp4DQcll5OrwTLDC/lF8Ow5td9Kf+FfiDHh/iZFlrm4XZ5tr15fcL82ld9Bh3Z5D0Y/6KEmyOJXo3DGYh3v3Hz+I3SrBcdI86hPrF0dxHc0WQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAU8k/l1M7UkLCstV4jHiMzhz4FKRrzBxlkFzfp5EQm9McMW0K9I43XEEh6fdbM37iug2LBp/80KeHJrI0cApflhnXQ6GqkXeyqb0wD9mqU1Mjhw3xWYfxAaeg2MmwpaXX8+bDCHXUDgBdPQDzOlEAS1iqQ4vLX+b8sh6RFXSGlKm/jF13zpKB1krIdoTNAfk+JOrsjpHJ/o8aAk4FiwnPGfrE7QLoHZ8zrUK0HuufEIIUMSsmLb3XAksuvzxKEXdYflsFoa0eV8MiWVcRCImYidzx1ih65ZnGE5WmWUCPJairScnM49K9sAaMvEBmyLYp6xeS3OcCQ5jF50EZTn2WR
77+
Use: encryption
78+
- EncryptionMethods: []
79+
KeyInfo:
80+
X509Data:
81+
X509Certificates:
82+
- Data: MIIC6jCCAdKgAwIBAgIGAZVrYwqeMA0GCSqGSIb3DQEBCwUAMDYxNDAyBgNVBAMMK09TUkJ1LVJmSVUzZTVaTzZ0TndBSTRLRGRqSG1aSXpIaXY1eDhLaF8yUWMwHhcNMjUwMzA2MTIxNjQ3WhcNMjUxMjMxMTIxNjQ3WjA2MTQwMgYDVQQDDCtPU1JCdS1SZklVM2U1Wk82dE53QUk0S0RkakhtWkl6SGl2NXg4S2hfMlFjMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmFCEjSeg3LDKrI/xWD13jpptxjeaiL1FMc2Xso+2jJa0dJrlN7eErSDpIcGF40BopSJcmb5va6BgjzzFoA7NA9uGfNLnkLAx8Qs81aERhxDuufy8iNqq0B2uqIhN9XCESQLyYNfoe7N26OXLgOgeBUlJOnUo+H27JdIn6TrVlp+tyBQBj5D2MDAzlgVoI3qCTWrTQKGwMGxzkQ0Oeq52WiHu2ONMbN1N7MM7UT1yXDp4DQcll5OrwTLDC/lF8Ow5td9Kf+FfiDHh/iZFlrm4XZ5tr15fcL82ld9Bh3Z5D0Y/6KEmyOJXo3DGYh3v3Hz+I3SrBcdI86hPrF0dxHc0WQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAU8k/l1M7UkLCstV4jHiMzhz4FKRrzBxlkFzfp5EQm9McMW0K9I43XEEh6fdbM37iug2LBp/80KeHJrI0cApflhnXQ6GqkXeyqb0wD9mqU1Mjhw3xWYfxAaeg2MmwpaXX8+bDCHXUDgBdPQDzOlEAS1iqQ4vLX+b8sh6RFXSGlKm/jF13zpKB1krIdoTNAfk+JOrsjpHJ/o8aAk4FiwnPGfrE7QLoHZ8zrUK0HuufEIIUMSsmLb3XAksuvzxKEXdYflsFoa0eV8MiWVcRCImYidzx1ih65ZnGE5WmWUCPJairScnM49K9sAaMvEBmyLYp6xeS3OcCQ5jF50EZTn2WR
83+
Use: signing
84+
ManageNameIDServices: []
85+
NameIDFormats:
86+
- ""
87+
ProtocolSupportEnumeration: urn:oasis:names:tc:SAML:2.0:protocol
88+
SingleLogoutServices: []
89+
ValidUntil: 2025-09-20T21:33:55.647Z
90+
WantAssertionsSigned: true
91+
ValidUntil: 2025-09-20T21:33:55.647Z
92+
saml_override_attributes: false
93+
saml_service_provider_id: https://postmance-dev.eu.authz.cloudentity.io/postmance-dev/customer-apps/saml/demo
94+
saml_signing_hash: sha-256
95+
scopes: []
96+
subject_type: public
97+
system: false
98+
tls_client_certificate_bound_access_tokens: false
99+
token_endpoint_auth_method: client_secret_basic
100+
token_exchange:
101+
actor_claims: []
102+
token_ttls:
103+
access_token_ttl: 1h0m0s
104+
authorization_code_ttl: 10m0s
105+
id_token_ttl: 1h0m0s
106+
refresh_token_ttl: 168h0m0s
107+
trusted: false
108+
use_custom_token_ttls: false
109+
userinfo_signed_response_alg: none

‎examples/e2e/base/workspaces/customer-apps/clients/User_Portal.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
id: customer-apps
2+
application_type: web
3+
application_types:
4+
- single_page
5+
- mobile_desktop
6+
audience:
7+
- customer-apps
8+
authorization_details_types: []
9+
authorization_signed_response_alg: RS256
10+
backchannel_logout_session_required: false
11+
backchannel_user_code_parameter: false
12+
client_name: User Portal
13+
client_secret_expires_at: 0
14+
client_status: active
15+
client_type: oauth2
16+
default_acr_values: []
17+
dpop_bound_access_tokens: false
18+
dynamically_registered: false
19+
fdx:
20+
contacts: []
21+
duration_period: 0
22+
duration_type: []
23+
intermediaries: []
24+
lookback_period: 0
25+
registry_references: []
26+
grant_types:
27+
- authorization_code
28+
hashed_rotated_secrets: []
29+
id_token_signed_response_alg: RS256
30+
introspection_endpoint_auth_method: none
31+
jwks:
32+
keys: []
33+
obbr:
34+
webhook_uris: []
35+
post_logout_redirect_uris: []
36+
redirect_uris:
37+
- https://{{ env "TENANT_ID" }}.eu.authz.cloudentity.io/{{ env "TENANT_ID" }}/customer-apps/app/callback
38+
- https://{{ env "TENANT_ID" }}.eu.authz.cloudentity.io/{{ env "TENANT_ID" }}/customer-apps/app/silent
39+
registration_token:
40+
expires_in: 0
41+
request_object_signing_alg: any
42+
request_uris: []
43+
require_pushed_authorization_requests: false
44+
response_types:
45+
- token
46+
- id_token
47+
- code
48+
- code id_token
49+
- token id_token
50+
- token code
51+
- token id_token code
52+
revocation_endpoint_auth_method: none
53+
rotated_secrets: []
54+
saml_allowed_attributes: []
55+
saml_metadata:
56+
AdditionalMetadataLocations: []
57+
AttributeAuthorityDescriptors: []
58+
AuthnAuthorityDescriptors: []
59+
CacheDuration: 0
60+
IDPSSODescriptors: []
61+
PDPDescriptors: []
62+
RoleDescriptors: []
63+
SPSSODescriptors: []
64+
ValidUntil: 0001-01-01T00:00:00.000Z
65+
saml_override_attributes: false
66+
saml_signing_hash: sha-256
67+
scopes:
68+
- email
69+
- introspect_tokens
70+
- list_clients_with_access
71+
- manage_consents
72+
- manage_sessions
73+
- manage_ss_profile
74+
- manage_tokens
75+
- offline_access
76+
- openid
77+
- profile
78+
- revoke_client_access
79+
- revoke_tokens
80+
- view_consents
81+
- view_sessions
82+
- view_ss_profile
83+
subject_type: public
84+
system: true
85+
tls_client_certificate_bound_access_tokens: false
86+
token_endpoint_auth_method: none
87+
token_exchange:
88+
actor_claims: []
89+
token_ttls:
90+
access_token_ttl: 1h0m0s
91+
authorization_code_ttl: 10m0s
92+
id_token_ttl: 1h0m0s
93+
refresh_token_ttl: 168h0m0s
94+
trusted: true
95+
use_custom_token_ttls: false
96+
userinfo_signed_response_alg: none

0 commit comments

Comments
 (0)