Skip to content

Commit c463d98

Browse files
jmattheisjmattheis
committed
test: oidc dex + authelia
1 parent 44bda75 commit c463d98

File tree

7 files changed

+235
-0
lines changed

7 files changed

+235
-0
lines changed

‎test/oidc/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
/dex/config/dex.db
2+
/authelia/config/*
3+
!/authelia/config/configuration.yml
4+
!/authelia/config/users_database.yml

‎test/oidc/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# OIDC Testing
2+
3+
## Dex
4+
5+
Check config in ./dex/config/dex.conf and do a `docker-compose up -d`.
6+
7+
Use this gotify config.
8+
```
9+
oidc:
10+
enabled: true
11+
issuer: http://127.0.0.1:5556/dex
12+
clientid: gotify
13+
clientsecret: secret
14+
redirecturl: http://127.0.0.1:8080/auth/oidc/callback
15+
```
16+
17+
When testing external apps like gotify/android change every occurence of
18+
127.0.0.1 in ./dex/config/dex.conf and in the gotify config above to an IP that's
19+
routed in your local network like 192.168.178.2.
20+
21+
## Authelia
22+
23+
Authelia requires SSL to work, so you'll have to create a valid certificate. This has to be executed in the directory this README resides.
24+
25+
```
26+
openssl req -x509 -newkey rsa:4096 -nodes -keyout ./authelia/config/key -out ./authelia/config/cert -days 365 -subj "/CN=127.0.0.1" -addext "subjectAltName=IP:127.0.0.1"
27+
```
28+
29+
Check config in ./authelia/config/configuration.yml and do a `docker-compose up -d`.
30+
31+
Use this gotify config.
32+
```
33+
oidc:
34+
enabled: true
35+
issuer: https://127.0.0.1:9091
36+
clientid: gotify
37+
clientsecret: secret
38+
redirecturl: http://127.0.0.1:8080/auth/oidc/callback
39+
```
40+
41+
When testing external apps like gotify/android change every occurence of
42+
127.0.0.1 in ./authelia/config/configuration.yml and in the gotify config above
43+
to an IP that's routed in your local network like 192.168.178.2. Also recreate
44+
the certificate with the adjusted IP.

‎test/oidc/authelia/config/configuration.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
# yamllint disable rule:comments-indentation
2+
---
3+
theme: 'auto'
4+
5+
server:
6+
tls:
7+
key: '/config/key'
8+
certificate: '/config/cert'
9+
identity_validation:
10+
reset_password:
11+
jwt_secret: 'a_very_important_secret'
12+
13+
authentication_backend:
14+
file:
15+
path: '/config/users_database.yml'
16+
password:
17+
algorithm: 'bcrypt'
18+
bcrypt:
19+
variant: 'standard'
20+
cost: 12
21+
access_control:
22+
default_policy: 'one_factor'
23+
24+
session:
25+
secret: 'a_very_important_secret'
26+
cookies:
27+
- name: 'authelia_session'
28+
domain: '127.0.0.1'
29+
authelia_url: 'https://127.0.0.1:9091'
30+
31+
storage:
32+
encryption_key: 'a_very_important_secret'
33+
local:
34+
path: '/config/db.sqlite3'
35+
36+
notifier:
37+
filesystem:
38+
filename: '/config/notification.txt'
39+
40+
identity_providers:
41+
oidc:
42+
jwks:
43+
- algorithm: 'RS256'
44+
use: 'sig'
45+
key: |
46+
-----BEGIN PRIVATE KEY-----
47+
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCPrHPExpLkhNYd
48+
5piRQzhWqMDAgqOjXhZHyYjfJYcanO76PimJe10c6ES9ULP1Iu0VltvE8ubI0Jek
49+
mF1nmQfYbw8efnP2zpodrPpMR6EqXMiaNFj2wd6Y0Mu0xqjvoDPHkB60kC2QqjiD
50+
1bFP280xXSl9yUeJK6PMM0mpWUJzDiW327OVTGs3AV0BU970KHs6XL6fZ3MNEo2V
51+
FGLRH+5g68THb1LxpKKaU+nIv/IRJBKZH80NNyzD1+TJQIkqAg2O9G3ozcgTP8zu
52+
yyeemn9snB+09SaL5/GnBOztYZ7jJnAbUrotx6BMSzrkuvfWrPB7G1O1CMMp4xUj
53+
ylM6/ciXIBpPLMPPVU9SfD4DyDH7XJ/S5NdvpJGNQcRSVG5JbdX4VPso2eze3Xa7
54+
/9BlAOh00WS/ZUoBjT0js1p1rjsD8U/bjMqG49Ids5pD1DElH+4uZNQ1xFq5GVbt
55+
ynd7GK+DF/XF+Vb56vYDVs0N/I6END8eeYCnUbCeWKwpKVN3XyX4wZ8Rp7mQiYna
56+
i1M4MENihS4HWvnfuswLkF5nLEpy0u5SV7Od3Mob8DPIZDeKt38WkTWTdDa3JeEv
57+
QU8Hv7r6hdIefMilJtZBS+QuJwzFtt+JeGbn5Xid7k3lTAGi7/uRXbE5H1YtTlQE
58+
S3XZAQ3tCEoclrP9N7E+Pm2YC+Jr5QIDAQABAoICABeiMg757TrrAP+9KXanvJJA
59+
wyhHtRxQA1E+vSWb2jwN+Z+vbwy+/sOdD4Wmy1t1KdPF05PzsvPwoClCqQa8HRbE
60+
uhN1kKTWOnLMPAYlOEUsKxF2r/WzUWcI3aF4llyImUvoEKz6FIy5+37wPXEaAohu
61+
vz8CR6KwS4rxGtphJPWhK6IxYTqbbf2H22E3BzNZn1+r1u2IyluppCGUT2cAHinS
62+
TrXRwa6fOuIxEIFl1a9tJCQNH6FfZJ04m9lhJM8EtG9CFPxZMWK9OXxEbdmAp5pZ
63+
mjudogAcoNstC75GsyjBb2qHMroKHvu92ku61774Brzxc1URwmzW/mi7RPKswXyf
64+
arOpk8l2rJZoJeQUnyJr+sab9SbW33pc6WTDEPMtllc26G6bjQggCYElPk035ed9
65+
eAJUXqiH/O2olS/jDwv/P9VqyDIAn75SpMVs0UvJKA6RSkOP5R/uF2gcOdYinluH
66+
jUkj5Wuqz1ewRW6RB2O6yocS8d5momnfQ0kvPGOeNLToQ4B7zRooO6rZBWziMwxr
67+
Vi2/8BX7SS7NQhz+mt7XwxsPkOcnx7+FL2tI+/FXwOikbFxieCI1IOaqNXQ1870i
68+
//iWVALHRRcF69jPODlqHcnio4UxxuddkJkSwJWSgoGECqTav0oQ6nr5Bldo53dD
69+
JlLfoGGSWHk64rhwuKDnAoIBAQDKcfpc0HFwFLz0PacY82XitaA9/cLSL0Axnu0p
70+
5iRIHU9MUitzYaaMLV1XMYZr6ItL0RnIHfqRaA5wloQTlibPbCCELQmiNhDp9Kv1
71+
h4TeICynJ3z9iPfsIJW3t+kovg7j2yiWhFZSwD9ktZBTrG6he8deE2y0Xw2apxRU
72+
NrlIeE33Gjnqo5SijcZ/VL89oJQr4lys93O0IqgETix2+RA6P2ouraPCvakL2flm
73+
V3T4ovki8qayxSirFJ4ew2E3hapukGAqZEodh+Rd3QHyaAmjixGOEgq0fmKDUvgH
74+
zCVGwkFHV0CUQrbK2blYQk55BjLrU7NAl0DppXjxLH+qfc4zAoIBAQC1rlZZZaVu
75+
08JuMZVR4TMOSmevJ8hLx+Upm7JOz8JNI+SGZQ/4hcoq2YTfdu26RFo86Yf+M2cn
76+
ZXuGcmMJIGRl0hhFl/8/1akRDPLXP5hWtJe3UIqDuA2WhTaonT9oOENAiijnnLuY
77+
za8nIHuYPOKSvryTsU1cxJf7FJbSG0kcVZCNREss6A8hCZB/idTeKwN8CNR1hS82
78+
zdBkFoo38G3ZYctHw5+uqzwrafT6BeG5WDqbfJkTpFWcvgPjPwWv1KNviDusRT68
79+
UqRuNAlO9z0tdU9VjK8v6BMPsv7CZQAEAVRlbHvaQW3LMPdKakE7Ud8qu8fWSkzw
80+
nS5cKAv2XZWHAoIBAQCZP9zho90rlldPoNg8eAxZqVorc0ympaQ3q/ImtJQkjyN3
81+
SACicHqORM0S82epijjgZOLabW8/4YCE1DwZQ6IPhO+8fwd65ui44kHGNRdsuvhy
82+
dN8WYjgjZKtRjwQOlolZDY9VGcrrC6Mxjow5+x8oWTYbziKNDCOVPgOSmHZ8GK4U
83+
b6MGL1yWDTMFMtcuRL/F1K6JNS0+YLnFwJPCYFpbbaPowANmqQIt+YzlXzEqAt0M
84+
CpoMXFmj4JCuAwM175aL6fkSPico4bULJQGTShR53A2m+Ztm9QGIHieqZ2yUevrF
85+
kZROZ45OUrEO0errjLjBEfRw4c7+0AeUsjXWjzOnAoIBAQCpuMZz1xAXm30sAefz
86+
SMSwWfPIXgqwOHotR4ToOQ/Tjm9C2ZB04088fl2xgGGOu6Hs+2COqSh5VkVyENPR
87+
x8/iisUf5mGOGaRKCGWnjYJbpXOBzZzIdh1DewjXtaZxTvYMicSyselSUvuIOsEb
88+
M+2ZltOFyYFy4zjzVoWam+DNtmVGgwETX2oau9ugOXuBXH9x1LHdY2D6+oPtrFzM
89+
6y9Dfycu0GIRA2g/SkmPdAUtZ23AqUI7Zi6QMbZiCRLf8m4HmCXexgVYWn+/b58u
90+
hKtDFy7YxYc24r9D0DxMD5xXIYLdCN4ewza1NfYeL2rm5pHrUubZmimMMdoIP2UF
91+
buFrAoIBAHMP3Qzd3VNQo2cDwrFZNtj1BuzDdr7t1N02M3IU5ivqxp/pZrPKwgUr
92+
rYPzHH3jKgi5YTSN/+Gy+1DHtED05KwwYKGP5UL0rXDzWAl/6G8HeRB4ag0K9q8A
93+
Nki7JA0pA7D7Z9/w+j4VINrXt/65ZX2MY1ZKmPEjrHWQzLZzBpZ8BWbJlBjMjNBw
94+
tWZ1BxdajoSVjG2h6okWI4yvV1VxMKvKei9HNjLKqNVn55qx4xKOxS+hcdHhmjQL
95+
9sa0D55tkspi3ZVzMZ3XrogElxMhSEpM5ivQoy9WvKk/R9EEAzFKIdY0LC3Zww2Z
96+
1+nG9oQcrdep1QE+8byjndJp/i6IBRU=
97+
-----END PRIVATE KEY-----
98+
99+
enable_client_debug_messages: true
100+
clients:
101+
- client_id: 'gotify'
102+
client_name: 'gotify'
103+
client_secret: '$pbkdf2-sha512$310000$PeubGcDkDhxS.WUNH6h04g$SQKuwJmUkPtQVWMz9nJoEUdvkYjRdkWEQO73zLiK4JRLapTWD9DYAHIt25h/FT1Nv059YSiMUpRUBbheSVJBAQ' # secret
104+
public: false
105+
authorization_policy: 'one_factor'
106+
require_pkce: true
107+
pkce_challenge_method: 'S256'
108+
consent_mode: implicit
109+
redirect_uris:
110+
- 'http://127.0.0.1:8080/auth/oidc/callback'
111+
- 'http://127.0.0.1:5173/auth/oidc/callback'
112+
- 'http://localhost:8080/auth/oidc/callback'
113+
- 'http://localhost:5173/auth/oidc/callback'
114+
- 'gotify://oidc/callback'
115+
scopes:
116+
- 'openid'
117+
- 'profile'
118+
- 'email'
119+
response_types:
120+
- 'code'
121+
grant_types:
122+
- 'authorization_code'
123+
access_token_signed_response_alg: 'none'
124+
userinfo_signed_response_alg: 'none'
125+
token_endpoint_auth_method: 'client_secret_basic'

‎test/oidc/authelia/config/users_database.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
users:
2+
user:
3+
displayname: "user"
4+
password: "$2a$10$JoPsdyz7c9Q1bqhw1.bHrefdNlOWY0/22VQZh33X9vDEl3Du1utqe" # password
5+
email: user@gotify.net

‎test/oidc/authelia/docker-compose.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
services:
2+
authelia:
3+
container_name: 'authelia'
4+
image: 'docker.io/authelia/authelia:latest'
5+
restart: 'unless-stopped'
6+
environment:
7+
- PUID=1000
8+
- PGID=1000
9+
ports:
10+
- 9091:9091
11+
volumes:
12+
- './config:/config'
13+
- './secrets:/secrets'

‎test/oidc/dex/config/dex.conf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
issuer: http://127.0.0.1:5556/dex
2+
3+
storage:
4+
type: sqlite3
5+
config:
6+
file: /config/dex.db
7+
web:
8+
http: 0.0.0.0:5556
9+
10+
staticClients:
11+
- id: gotify
12+
redirectURIs:
13+
- 'http://localhost:8080/auth/oidc/callback'
14+
- 'http://localhost:5173/auth/oidc/callback'
15+
- 'http://127.0.0.1:8080/auth/oidc/callback'
16+
- 'http://127.0.0.1:5173/auth/oidc/callback'
17+
- 'gotify://oidc/callback'
18+
name: 'Gotify'
19+
secret: secret
20+
21+
enablePasswordDB: true
22+
23+
staticPasswords:
24+
- email: "user@gotify.net"
25+
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # password
26+
username: "user"
27+
name: "USER"
28+
emailVerified: true
29+
preferredUsername: "user"
30+
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
31+
32+
signer:
33+
type: local
34+
config:
35+
keysRotationPeriod: "6h"

‎test/oidc/dex/docker-compose.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
services:
2+
dex:
3+
image: ghcr.io/dexidp/dex:latest
4+
command: dex serve /config/dex.conf
5+
user: '1000'
6+
ports:
7+
- 5556:5556
8+
volumes:
9+
- ./config/:/config

0 commit comments

Comments
 (0)