mirror of https://github.com/dexidp/dex.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
222 lines
6.8 KiB
222 lines
6.8 KiB
# DEPRECATED: use config.yaml.dist and config.dev.yaml examples in the repository root. |
|
# TODO: keep this until all references are updated. |
|
|
|
# The base path of dex and the external name of the OpenID Connect service. |
|
# This is the canonical URL that all clients MUST use to refer to dex. If a |
|
# path is provided, dex's HTTP service will listen at a non-root URL. |
|
issuer: http://127.0.0.1:5556/dex |
|
|
|
# The storage configuration determines where dex stores its state. Supported |
|
# options include SQL flavors and Kubernetes third party resources. |
|
# |
|
# See the documentation (https://dexidp.io/docs/storage/) for further information. |
|
storage: |
|
type: sqlite3 |
|
config: |
|
file: examples/dex.db |
|
|
|
# type: mysql |
|
# config: |
|
# host: localhost |
|
# port: 3306 |
|
# database: dex |
|
# user: mysql |
|
# password: mysql |
|
# ssl: |
|
# mode: "false" |
|
|
|
# type: postgres |
|
# config: |
|
# host: localhost |
|
# port: 5432 |
|
# database: dex |
|
# user: postgres |
|
# password: postgres |
|
# ssl: |
|
# mode: disable |
|
|
|
# type: etcd |
|
# config: |
|
# endpoints: |
|
# - http://localhost:2379 |
|
# namespace: dex/ |
|
|
|
# type: kubernetes |
|
# config: |
|
# kubeConfigFile: $HOME/.kube/config |
|
|
|
# Configuration for the HTTP endpoints. |
|
web: |
|
http: 0.0.0.0:5556 |
|
# Uncomment for HTTPS options. |
|
# https: 127.0.0.1:5554 |
|
# tlsCert: /etc/dex/tls.crt |
|
# tlsKey: /etc/dex/tls.key |
|
# headers: |
|
# X-Frame-Options: "DENY" |
|
# X-Content-Type-Options: "nosniff" |
|
# X-XSS-Protection: "1; mode=block" |
|
# Content-Security-Policy: "default-src 'self'" |
|
# Strict-Transport-Security: "max-age=31536000; includeSubDomains" |
|
# clientRemoteIP: |
|
# header: X-Forwarded-For |
|
# trustedProxies: |
|
# - 10.0.0.0/8 |
|
|
|
# Configuration for dex appearance |
|
# frontend: |
|
# issuer: dex |
|
# logoURL: theme/logo.png |
|
# dir: web/ |
|
# Allowed values: light, dark |
|
# theme: light |
|
|
|
# Configuration for telemetry |
|
telemetry: |
|
http: 0.0.0.0:5558 |
|
# enableProfiling: true |
|
|
|
# Uncomment this block to enable the gRPC API. This values MUST be different |
|
# from the HTTP endpoints. |
|
# grpc: |
|
# addr: 127.0.0.1:5557 |
|
# tlsCert: examples/grpc-client/server.crt |
|
# tlsKey: examples/grpc-client/server.key |
|
# tlsClientCA: examples/grpc-client/ca.crt |
|
|
|
# Uncomment this block to enable configuration for the expiration time durations. |
|
# Is possible to specify units using only s, m and h suffixes. |
|
# expiry: |
|
# deviceRequests: "5m" |
|
# signingKeys: "6h" |
|
# idTokens: "24h" |
|
# refreshTokens: |
|
# reuseInterval: "3s" |
|
# validIfNotUsedFor: "2160h" # 90 days |
|
# absoluteLifetime: "3960h" # 165 days |
|
|
|
# Options for controlling the logger. |
|
# logger: |
|
# level: "debug" |
|
# format: "text" # can also be "json" |
|
|
|
# Default values shown below |
|
# oauth2: |
|
# # grantTypes determines the allowed set of authorization flows. |
|
# grantTypes: |
|
# - "authorization_code" |
|
# - "client_credentials" |
|
# - "refresh_token" |
|
# - "implicit" |
|
# - "password" |
|
# - "urn:ietf:params:oauth:grant-type:device_code" |
|
# - "urn:ietf:params:oauth:grant-type:token-exchange" |
|
# # responseTypes determines the allowed response contents of a successful authorization flow. |
|
# # use ["code", "token", "id_token"] to enable implicit flow for web-only clients. |
|
# responseTypes: [ "code" ] # also allowed are "token" and "id_token" |
|
# # By default, Dex will ask for approval to share data with application |
|
# # (approval for sharing data from connected IdP to Dex is separate process on IdP) |
|
# skipApprovalScreen: false |
|
# # If only one authentication method is enabled, the default behavior is to |
|
# # go directly to it. For connected IdPs, this redirects the browser away |
|
# # from application to upstream provider such as the Google login page |
|
# alwaysShowLoginScreen: false |
|
# # Uncomment the passwordConnector to use a specific connector for password grants |
|
# passwordConnector: local |
|
# # PKCE (Proof Key for Code Exchange) configuration |
|
# pkce: |
|
# # If true, PKCE is required for all authorization code flows (OAuth 2.1). |
|
# enforce: false |
|
# # Supported code challenge methods. Defaults to ["S256", "plain"]. |
|
# codeChallengeMethodsSupported: ["S256", "plain"] |
|
|
|
# Instead of reading from an external storage, use this list of clients. |
|
# |
|
# If this option isn't chosen clients may be added through the gRPC API. |
|
staticClients: |
|
- id: example-app |
|
redirectURIs: |
|
- 'http://127.0.0.1:5555/callback' |
|
- '/dex/device/callback' |
|
name: 'Example App' |
|
secret: ZXhhbXBsZS1hcHAtc2VjcmV0 |
|
# Optional: restrict which connectors this client can use for authentication. |
|
# If omitted or empty, all connectors are allowed. |
|
# allowedConnectors: |
|
# - mock |
|
|
|
# Example using environment variables |
|
# Set DEX_CLIENT_ID and DEX_SECURE_CLIENT_SECRET before starting Dex |
|
# - idEnv: DEX_CLIENT_ID |
|
# secretEnv: DEX_CLIENT_SECRET |
|
# redirectURIs: |
|
# - 'http://127.0.0.1:5556/callback' |
|
# name: 'Secure Example App' |
|
|
|
# - id: example-device-client |
|
# redirectURIs: |
|
# - /device/callback |
|
# name: 'Static Client for Device Flow' |
|
# public: true |
|
|
|
connectors: |
|
- type: mockCallback |
|
id: mock |
|
name: Example |
|
# grantTypes restricts which grant types can use this connector. |
|
# If not specified, all grant types are allowed. |
|
# Supported values: |
|
# - "authorization_code" |
|
# - "implicit" |
|
# - "refresh_token" |
|
# - "password" |
|
# - "urn:ietf:params:oauth:grant-type:device_code" |
|
# - "urn:ietf:params:oauth:grant-type:token-exchange" |
|
# grantTypes: |
|
# - "authorization_code" |
|
# - "refresh_token" |
|
# - type: google |
|
# id: google |
|
# name: Google |
|
# config: |
|
# issuer: https://accounts.google.com |
|
# # Connector config values starting with a "$" will read from the environment. |
|
# clientID: $GOOGLE_CLIENT_ID |
|
# clientSecret: $GOOGLE_CLIENT_SECRET |
|
# redirectURI: http://127.0.0.1:5556/dex/callback |
|
# hostedDomains: |
|
# - $GOOGLE_HOSTED_DOMAIN |
|
|
|
# Let dex keep a list of passwords which can be used to login to dex. |
|
enablePasswordDB: true |
|
|
|
# A static list of passwords to login the end user. By identifying here, dex |
|
# won't look in its underlying storage for passwords. |
|
# |
|
# If this option isn't chosen users may be added through the gRPC API. |
|
staticPasswords: |
|
- email: "admin@example.com" |
|
# bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2) |
|
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" |
|
username: "admin" |
|
name: "Admin User" |
|
emailVerified: true |
|
preferredUsername: "admin" |
|
groups: |
|
- "team-a" |
|
- "team-a/admins" |
|
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466" |
|
|
|
# Settings for signing JWT tokens. Available options: |
|
# - "local": use local keys (only RSA keys supported) |
|
# - "vault": use Vault Transit backend (RSA and EC keys supported) |
|
signer: |
|
type: local |
|
config: |
|
keysRotationPeriod: "6h" |
|
# signer |
|
# type: vault |
|
# config: |
|
# addr: http://127.0.0.1:8200 |
|
# token: root |
|
# keyName: dex-key
|
|
|