---
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    http:
      anonymous_auth_enabled: false
    authc:
      basic_internal_auth_domain:
        description: "HTTP basic auth against internal_users.yml (service accounts only)."
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: internal
{% if WAZUH_OIDC_ENABLED %}
      openid_auth_domain:
        description: "Native OIDC against Keycloak's discovery endpoint (no oauth2-proxy sidecar)."
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: openid
          challenge: true
          config:
            subject_key: "{{ OIDC.ATTRIBUTES.USERNAME }}"
            roles_key: groups
            openid_connect_url: "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}"
        authentication_backend:
          type: noop
{% endif %}
{% if WAZUH_LDAP_ENABLED %}
    authz:
      ldap_authz_domain:
        description: "Authorization only: enrich the authenticated user with backend_roles from LDAP group membership. Never used to verify a password."
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          type: ldap
          config:
            hosts:
              - "{{ LDAP.SERVER.URI | regex_replace('^ldaps?://', '') }}"
            enable_ssl: "{{ LDAP.SERVER.SECURITY == 'ldaps' }}"
            enable_start_tls: "{{ LDAP.SERVER.SECURITY == 'starttls' }}"
            verify_hostnames: true
            bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
            password: "{{ LDAP.BIND_CREDENTIAL }}"
            userbase: "{{ LDAP.DN.OU.USERS }}"
            usersearch: "({{ LDAP.USER.ATTRIBUTES.ID }}={0})"
            username_attribute: "{{ LDAP.USER.ATTRIBUTES.ID }}"
            rolebase: "{{ LDAP.DN.OU.ROLES }}"
            rolesearch: "(member={0})"
            userroleattribute: null
            userrolename: "disabled"
            rolename: "cn"
            resolve_nested_roles: true
            skip_users:
              - "{{ WAZUH_INDEXER_ADMIN_USERNAME }}"
              - "{{ WAZUH_DASHBOARD_SERVICE_USERNAME }}"
{% endif %}