Authentik auth

authentik/blueprints/mm-custom-authentication-flow.yaml

@@ -0,0 +1,100 @@
+version: 1
+metadata:
+  name: Million Miles Authentik POC
+entries:
+  - model: authentik_flows.flow
+    id: mm-custom-authentication-flow
+    identifiers:
+      slug: mm-custom-authentication-flow
+    attrs:
+      name: Million Miles Custom Authentication
+      title: Million Miles
+      designation: authentication
+      authentication: none
+      layout: stacked
+      denied_action: message_continue
+
+  - model: authentik_stages_password.passwordstage
+    id: mm-custom-authentication-password
+    identifiers:
+      name: mm-custom-authentication-password
+    attrs:
+      backends:
+        - authentik.core.auth.InbuiltBackend
+      failed_attempts_before_cancel: 5
+      allow_show_password: true
+
+  - model: authentik_stages_identification.identificationstage
+    id: mm-custom-authentication-identification
+    identifiers:
+      name: mm-custom-authentication-identification
+    attrs:
+      user_fields:
+        - email
+        - username
+      case_insensitive_matching: true
+      show_matched_user: false
+      password_stage: !KeyOf mm-custom-authentication-password
+
+  - model: authentik_stages_user_login.userloginstage
+    id: mm-custom-authentication-login
+    identifiers:
+      name: mm-custom-authentication-login
+    attrs:
+      session_duration: hours=8
+
+  - model: authentik_flows.flowstagebinding
+    identifiers:
+      target: !KeyOf mm-custom-authentication-flow
+      stage: !KeyOf mm-custom-authentication-identification
+      order: 10
+    attrs:
+      re_evaluate_policies: true
+      invalid_response_action: retry
+      policy_engine_mode: all
+
+  - model: authentik_flows.flowstagebinding
+    identifiers:
+      target: !KeyOf mm-custom-authentication-flow
+      stage: !KeyOf mm-custom-authentication-login
+      order: 20
+    attrs:
+      re_evaluate_policies: true
+      invalid_response_action: retry
+      policy_engine_mode: all
+
+  - model: authentik_providers_oauth2.oauth2provider
+    id: mm-custom-frontend-provider
+    identifiers:
+      name: Million Miles Custom Frontend
+    attrs:
+      name: Million Miles Custom Frontend
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: confidential
+      client_id: mm-custom-frontend
+      client_secret: mm-custom-secret
+      access_code_validity: minutes=10
+      access_token_validity: minutes=5
+      refresh_token_validity: days=30
+      include_claims_in_id_token: true
+      issuer_mode: per_provider
+      sub_mode: hashed_user_id
+      signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+      redirect_uris:
+        - url: http://localhost:3000/auth/callback
+          matching_mode: strict
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
+
+  - model: authentik_core.application
+    id: mm-custom-frontend-application
+    identifiers:
+      slug: mm-custom-frontend
+    attrs:
+      name: Million Miles
+      slug: mm-custom-frontend
+      provider: !KeyOf mm-custom-frontend-provider
+      policy_engine_mode: any