wmantly
28016376ad
Pass optional CFG_LDAPS_HOST from setup.env through setup.sh into the generated ./config/sso-secrets.js as ldap.ldapsHost. This lets operators advertise an internal-only LDAPS hostname (e.g. ldap.internal.example.com or sso-manager) on the SSO /integrations page instead of the public OAuth issuer, avoiding a public 636 port forward. - setup.env.example: add CFG_LDAPS_HOST - setup.sh: read/forward CFG_LDAPS_HOST into sso-secrets.js - config.example/sso-secrets.js.example: document ldapsHost/ldapsPort - .env.example: add LDAPS_HOST for legacy .env migrations - docker-compose.yml: comment warning against public 636 forwarding - README.md: explain CFG_LDAPS_HOST recommendation - CHANGELOG.md + bump version to 1.1.19 Co-authored-by: Claude <noreply@anthropic.com>
48 lines
2.3 KiB
Plaintext
48 lines
2.3 KiB
Plaintext
'use strict';
|
|
// Example SSO secrets for the theta-env unified stack. Copy to
|
|
// ./config/sso-secrets.js (NOT this file — ./config/ is gitignored) and edit.
|
|
// `./setup.sh` generates ./config/sso-secrets.js for you on first run; this file
|
|
// documents the shape for manual editing / reference.
|
|
//
|
|
// The SSO app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
|
|
// CONF_SECRETS to point at it). The app ignores the extra stack/bootstrap/
|
|
// serviceAccountPass keys (read by the orchestrator). Back this up off-host —
|
|
// it holds all SSO secrets. Never commit ./config/.
|
|
|
|
module.exports = {
|
|
name: 'SSO Manager', // shown in UI + outbound email
|
|
ldap: {
|
|
url: 'ldap://localhost:389', // the bundled slapd (in-container)
|
|
bindDN: 'cn=admin,dc=example,dc=com', // slapd root DN
|
|
bindPassword: 'CHANGE-ME', // slapd root + app bind password
|
|
userBase: 'ou=people,dc=example,dc=com',
|
|
groupBase: 'ou=groups,dc=example,dc=com',
|
|
// ldapsHost: 'ldap.internal.example.com', // optional: internal-only hostname
|
|
// shown on /integrations for direct LDAPS binds. Empty -> derive from issuer.
|
|
// ldapsPort: 636,
|
|
},
|
|
smtp: { // optional; leave host '' to skip
|
|
host: '', port: 587, secure: false,
|
|
user: '', pass: '', from: '',
|
|
},
|
|
oauth: {
|
|
issuer: 'https://sso.example.com', // browser-facing SSO URL
|
|
jwtSecret: 'CHANGE-ME', // signs all tokens — keep secret
|
|
token_lifetime: { access_token: 3600, refresh_token: 2592000 },
|
|
},
|
|
|
|
// ── Orchestrator-only (ignored by the app; read by setup.sh + bootstrap) ──
|
|
stack: {
|
|
ldapBaseDn: 'dc=example,dc=com', // slapd suffix (drives seed OUs)
|
|
ldapDomain: 'example.com', // default cert CN + issuer host
|
|
ldapCertCn: '', // cert CN; '' -> defaults to ldapDomain
|
|
ssoHost: 'sso.example.com', // public SSO hostname
|
|
proxyHost: 'proxy.example.com', // public proxy hostname
|
|
},
|
|
bootstrap: {
|
|
adminUid: 'admin', // first SSO admin username
|
|
adminPass: 'CHANGE-ME', // first SSO admin password
|
|
adminEmail: 'admin@proxy.example.com', // first SSO admin email
|
|
},
|
|
serviceAccountPass: 'CHANGE-ME', // LDAP password the proxy binds with
|
|
}; |