58da15c825
Add a /forward-auth endpoint that validates the existing Porchlight session for reverse proxies and returns identity headers for authenticated active users. Unauthenticated or inactive sessions redirect to login, with optional post-login return targets reconstructed from proxy headers and constrained by an allowed host list. Also add forward_auth_allowed_redirect_hosts configuration, preserve validated forward-auth return targets through login/session reset, exempt the endpoint from CSRF for proxy subrequests, document configuration, and cover the flow with tests.
24 lines
882 B
TOML
24 lines
882 B
TOML
# Porchlight OIDC Provider Configuration
|
|
#
|
|
# Copy this file to porchlight.toml and edit to suit your deployment.
|
|
# Environment variables (OIDC_OP_*) override values set here.
|
|
# To use a different path: export OIDC_OP_CONFIG_FILE=/path/to/config.toml
|
|
|
|
issuer = "https://auth.example.com"
|
|
|
|
# debug = false
|
|
# session_secret = "generate-a-random-string-here"
|
|
# sqlite_path = "data/oidc_op.db"
|
|
# signing_key_path = "data/keys"
|
|
# invite_ttl = 86400
|
|
# forward_auth_allowed_redirect_hosts = ["app.example.com", "*.apps.example.com"]
|
|
|
|
# Register OIDC Relying Party clients below.
|
|
# Each [clients.<client-id>] section defines one client.
|
|
|
|
# [clients.my-webapp]
|
|
# client_secret = "change-me-to-a-long-random-string"
|
|
# redirect_uris = ["https://app.example.com/callback"]
|
|
# response_types = ["code"]
|
|
# scope = ["openid", "profile", "email"]
|
|
# token_endpoint_auth_method = "client_secret_basic"
|