2017-01-22 23:54:45 +07:00
|
|
|
|
2017-03-22 02:57:03 +07:00
|
|
|
# The port to listen on
|
2017-03-25 21:17:21 +07:00
|
|
|
port: 80
|
2017-03-22 02:57:03 +07:00
|
|
|
|
2017-03-25 21:17:21 +07:00
|
|
|
# Log level
|
|
|
|
|
#
|
2017-03-16 05:07:57 +07:00
|
|
|
# Level of verbosity for logs
|
2017-01-29 01:59:15 +07:00
|
|
|
logs_level: info
|
2017-01-23 00:18:19 +07:00
|
|
|
|
2017-03-25 21:17:21 +07:00
|
|
|
# LDAP configuration
|
|
|
|
|
#
|
2017-03-16 07:25:55 +07:00
|
|
|
# Example: for user john, the DN will be cn=john,ou=users,dc=example,dc=com
|
2017-01-22 23:54:45 +07:00
|
|
|
ldap:
|
2017-03-25 21:17:21 +07:00
|
|
|
# The url of the ldap server
|
2017-01-22 23:54:45 +07:00
|
|
|
url: ldap://ldap
|
2017-03-25 21:17:21 +07:00
|
|
|
|
|
|
|
|
# The base dn for every entries
|
|
|
|
|
base_dn: dc=example,dc=com
|
|
|
|
|
|
|
|
|
|
# An additional dn to define the scope to all users
|
|
|
|
|
additional_user_dn: ou=users
|
|
|
|
|
|
|
|
|
|
# The user name attribute of users. Might uid for FreeIPA. 'cn' by default.
|
|
|
|
|
user_name_attribute: cn
|
|
|
|
|
|
|
|
|
|
# An additional dn to define the scope of groups
|
|
|
|
|
additional_group_dn: ou=groups
|
|
|
|
|
|
|
|
|
|
# The group name attribute of group. 'cn' by default.
|
|
|
|
|
group_name_attribute: cn
|
|
|
|
|
|
|
|
|
|
# The username and password of the admin user.
|
2017-01-27 07:20:03 +07:00
|
|
|
user: cn=admin,dc=example,dc=com
|
|
|
|
|
password: password
|
2017-01-22 23:54:45 +07:00
|
|
|
|
2017-03-16 05:07:57 +07:00
|
|
|
|
2017-03-25 21:17:21 +07:00
|
|
|
# Access Control
|
|
|
|
|
#
|
|
|
|
|
# Access control is a set of rules where you can specify a group-based
|
|
|
|
|
# subdomain restrictions.
|
|
|
|
|
#
|
|
|
|
|
# If access_control is not defined, ACL rules are disabled and default policy
|
|
|
|
|
# is allowed to everyone.
|
|
|
|
|
# Otherwise, the default policy is denied for any user and any subdomain.
|
|
|
|
|
access_control:
|
|
|
|
|
- group: admin
|
|
|
|
|
allowed_domains:
|
|
|
|
|
- secret.test.local
|
|
|
|
|
- secret1.test.local
|
2017-03-25 21:38:27 +07:00
|
|
|
- secret2.test.local
|
2017-03-25 21:17:21 +07:00
|
|
|
- group: dev
|
|
|
|
|
allowed_domains:
|
|
|
|
|
- secret2.test.local
|
2017-03-25 21:28:57 +07:00
|
|
|
- user: harry
|
|
|
|
|
allowed_domains:
|
|
|
|
|
- secret1.test.local
|
2017-03-25 21:17:21 +07:00
|
|
|
|
|
|
|
|
|
2017-03-16 05:07:57 +07:00
|
|
|
# Configuration of session cookies
|
|
|
|
|
#
|
|
|
|
|
# _secret_ the secret to encrypt session cookies
|
|
|
|
|
# _expiration_ the time before cookies expire
|
|
|
|
|
# _domain_ the domain to protect.
|
|
|
|
|
# Note: the authenticator must also be in that domain. If empty, the cookie
|
|
|
|
|
# is restricted to the subdomain of the issuer.
|
2017-01-22 23:54:45 +07:00
|
|
|
session:
|
|
|
|
|
secret: unsecure_secret
|
|
|
|
|
expiration: 3600000
|
2017-03-16 05:07:57 +07:00
|
|
|
domain: example.com
|
|
|
|
|
|
2017-01-22 23:54:45 +07:00
|
|
|
|
2017-03-16 05:07:57 +07:00
|
|
|
# The directory where the DB files will be saved
|
2017-01-29 01:59:15 +07:00
|
|
|
store_directory: /var/lib/auth-server/store
|
2017-01-22 23:54:45 +07:00
|
|
|
|
2017-01-29 01:59:15 +07:00
|
|
|
|
2017-03-16 05:07:57 +07:00
|
|
|
# Notifications are sent to users when they require a password reset, a u2f
|
|
|
|
|
# registration or a TOTP registration.
|
|
|
|
|
# Use only one available configuration: filesystem, gmail
|
2017-01-22 23:54:45 +07:00
|
|
|
notifier:
|
2017-03-16 05:07:57 +07:00
|
|
|
# For testing purpose, notifications can be sent in a file
|
2017-01-29 01:59:15 +07:00
|
|
|
filesystem:
|
|
|
|
|
filename: /var/lib/auth-server/notifications/notification.txt
|
|
|
|
|
|
2017-03-16 05:07:57 +07:00
|
|
|
# Use your gmail account to send the notifications. You can use an app password.
|
2017-01-29 01:59:15 +07:00
|
|
|
# gmail:
|
|
|
|
|
# username: user@example.com
|
|
|
|
|
# password: yourpassword
|
2017-01-22 23:54:45 +07:00
|
|
|
|
