mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
aa6bbe3b20
SOFTWARE_NAME, SOFTWARE_DOMAIN, SOFTWARE_URL and ORGANIZATION are declared once in group_vars/all/00_general.yml and derive from each other. Eleven templates wrote the value instead, so a rename would reach the four declarations and every consumer that reads them, and silently miss the literal. The lint reads the name from the declaration rather than carrying it, and searches case-insensitively: the domain is the name lowered, the URL is https:// plus the domain and the organization is the name again, so one literal finds the value of all four. A hit is reported with the variable it should have been, derived from the scheme in front of it and its case. The escape is nocheck: software-identity, same line or the one above. Every migrated template renders the same bytes as before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
116 lines
4.6 KiB
Django/Jinja
116 lines
4.6 KiB
Django/Jinja
<?xml version="1.0" encoding="utf-8"?>
|
|
<kix_config version="1.0" init="Application">
|
|
<ConfigItem AccessLevel="confidential" Name="Authentication###100-Infinito-LDAP" Required="1" Valid="1" ConfigLevel="200">
|
|
<Description Translatable="1">{{ SOFTWARE_NAME }} LDAP backend (svc-db-openldap) for the web-app-kix-administrator role group. Authenticates KIX agents via Auth::LDAP and provisions the contact via Auth::Sync::LDAP.</Description>
|
|
<Group>Framework</Group>
|
|
<Setting>
|
|
<Object>[
|
|
{
|
|
"Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-administrator)",
|
|
"Enabled": 1,
|
|
"UsageContext": "Agent",
|
|
"Module": "Kernel::System::Auth::LDAP",
|
|
"Config": {
|
|
"Host": "{{ KIX_LDAP_HOST }}",
|
|
"Params": {
|
|
"async": 0,
|
|
"port": {{ KIX_LDAP_PORT }},
|
|
"timeout": 10,
|
|
"version": 3
|
|
},
|
|
"BaseDN": "{{ KIX_LDAP_BASE_DN }}",
|
|
"AlwaysFilter": "(objectclass=inetOrgPerson)",
|
|
"Charset": "utf-8",
|
|
"SearchUserDN": "{{ KIX_LDAP_BIND_DN }}",
|
|
"SearchUserPw": "{{ KIX_LDAP_BIND_PW }}",
|
|
"GroupDN": "{{ KIX_LDAP_ADMINISTRATOR_GROUP_DN }}",
|
|
"AccessAttr": "member",
|
|
"UID": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"UserAttr": "DN",
|
|
"AuthAttr": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"UserSuffix": "",
|
|
"Debug": 1
|
|
},
|
|
"Sync": [
|
|
{
|
|
"Enabled": 1,
|
|
"Module": "Kernel::System::Auth::Sync::LDAP",
|
|
"Config": {
|
|
"ContactUserSync": {
|
|
"Email": "mail",
|
|
"Firstname": "givenName",
|
|
"Lastname": "sn",
|
|
"UserLogin": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"PrimaryOrganisationID": "SET:1"
|
|
},
|
|
"GroupDNBasedUsageContextSync": {
|
|
"{{ KIX_LDAP_ADMINISTRATOR_GROUP_DN }}": {
|
|
"IsAgent": 1,
|
|
"IsCustomer": 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]</Object>
|
|
</Setting>
|
|
</ConfigItem>
|
|
<ConfigItem AccessLevel="confidential" Name="Authentication###200-Infinito-LDAP-User" Required="1" Valid="1" ConfigLevel="200">
|
|
<Description Translatable="1">Second {{ SOFTWARE_NAME }} LDAP backend for the web-app-kix-user role group. KIX iterates over Authentication entries; if the administrator backend (###100) refuses (user not in admin group), this one tries the user group. The OAuth2-proxy `allowed_groups` filter still lets only members of either group through, so this backend never sees a user without an {{ SOFTWARE_NAME }} role.</Description>
|
|
<Group>Framework</Group>
|
|
<Setting>
|
|
<Object>[
|
|
{
|
|
"Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-user)",
|
|
"Enabled": 1,
|
|
"UsageContext": "Agent",
|
|
"Module": "Kernel::System::Auth::LDAP",
|
|
"Config": {
|
|
"Host": "{{ KIX_LDAP_HOST }}",
|
|
"Params": {
|
|
"async": 0,
|
|
"port": {{ KIX_LDAP_PORT }},
|
|
"timeout": 10,
|
|
"version": 3
|
|
},
|
|
"BaseDN": "{{ KIX_LDAP_BASE_DN }}",
|
|
"AlwaysFilter": "(objectclass=inetOrgPerson)",
|
|
"Charset": "utf-8",
|
|
"SearchUserDN": "{{ KIX_LDAP_BIND_DN }}",
|
|
"SearchUserPw": "{{ KIX_LDAP_BIND_PW }}",
|
|
"GroupDN": "{{ KIX_LDAP_USER_GROUP_DN }}",
|
|
"AccessAttr": "member",
|
|
"UID": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"UserAttr": "DN",
|
|
"AuthAttr": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"UserSuffix": "",
|
|
"Debug": 1
|
|
},
|
|
"Sync": [
|
|
{
|
|
"Enabled": 1,
|
|
"Module": "Kernel::System::Auth::Sync::LDAP",
|
|
"Config": {
|
|
"ContactUserSync": {
|
|
"Email": "mail",
|
|
"Firstname": "givenName",
|
|
"Lastname": "sn",
|
|
"UserLogin": "{{ KIX_LDAP_UID_ATTR }}",
|
|
"PrimaryOrganisationID": "SET:1"
|
|
},
|
|
"GroupDNBasedUsageContextSync": {
|
|
"{{ KIX_LDAP_USER_GROUP_DN }}": {
|
|
"IsAgent": 1,
|
|
"IsCustomer": 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]</Object>
|
|
</Setting>
|
|
</ConfigItem>
|
|
</kix_config>
|