danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

authelia: add extraOidcAuthorizationPolicies option

Browse source 
This is needed for example to only authorize users of a given group to access a service.
Usually, the application itself enforces this but some don't.
This commit is contained in:
ibizaman 2025-09-29 20:56:09 +02:00 committed by Pierre Penninckx
parent 5b40cf3707
commit 139ceca768
2 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
docs/redirects.json
View file

@ -80,6 +80,9 @@
"blocks-authelia-options-shb.authelia.extraDefinitions": [ "blocks-authelia-options-shb.authelia.extraDefinitions": [
"blocks-authelia.html#blocks-authelia-options-shb.authelia.extraDefinitions" "blocks-authelia.html#blocks-authelia-options-shb.authelia.extraDefinitions"
], ],
"blocks-authelia-options-shb.authelia.extraOidcAuthorizationPolicies": [
"blocks-authelia.html#blocks-authelia-options-shb.authelia.extraOidcAuthorizationPolicies"
],
"blocks-authelia-options-shb.authelia.extraOidcClaimsPolicies": [ "blocks-authelia-options-shb.authelia.extraOidcClaimsPolicies": [
"blocks-authelia.html#blocks-authelia-options-shb.authelia.extraOidcClaimsPolicies" "blocks-authelia.html#blocks-authelia-options-shb.authelia.extraOidcClaimsPolicies"
], ],

9
modules/blocks/authelia.nix
View file

@ -157,6 +157,12 @@ in
default = {}; default = {};
}; };
extraOidcAuthorizationPolicies = lib.mkOption {
description = "Extra OIDC authorization policies.";
type = lib.types.attrsOf lib.types.attrs;
default = {};
};
extraDefinitions = lib.mkOption { extraDefinitions = lib.mkOption {
description = "Extra definitions."; description = "Extra definitions.";
type = lib.types.attrsOf lib.types.attrs; type = lib.types.attrsOf lib.types.attrs;
@ -216,7 +222,7 @@ in
}; };
authorization_policy = lib.mkOption { authorization_policy = lib.mkOption {
type = lib.types.enum [ "one_factor" "two_factor" ]; type = lib.types.enum ([ "one_factor" "two_factor" ] ++ lib.attrNames cfg.extraOidcAuthorizationPolicies);
description = "Require one factor (password) or two factor (device) authentication."; description = "Require one factor (password) or two factor (device) authentication.";
default = "one_factor"; default = "one_factor";
}; };
@ -491,6 +497,7 @@ in
default.id_token = [ "email" "preferred_username" "name" "groups" ]; default.id_token = [ "email" "preferred_username" "name" "groups" ];
} // cfg.extraOidcClaimsPolicies; } // cfg.extraOidcClaimsPolicies;
scopes = cfg.extraOidcScopes; scopes = cfg.extraOidcScopes;
authorization_policies = cfg.extraOidcAuthorizationPolicies;
}; };
} // lib.optionalAttrs (cfg.extraDefinitions != {}) { } // lib.optionalAttrs (cfg.extraDefinitions != {}) {
definitions = cfg.extraDefinitions; definitions = cfg.extraDefinitions;