mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-03 03:38:15 +00:00
Kevin Veen-Birkenbach
9e874408a7
- Switched Drupal base image to PHP 8.2 for compatibility with openid_connect 2.x - Added mariadb-client to container to allow Drush to drop tables - Upgraded OIDC module from ^1 to ^2@beta for entity-based client configuration - Replaced legacy client creation task with generic plugin-based entity creation - Ensured /usr/local/bin is in PATH for www-data user - Updated oidc.yml to explicitly use the generic plugin References: https://chatgpt.com/share/6905cecc-8e3c-800f-849b-4041b6925381
35 lines
1.6 KiB
YAML
35 lines
1.6 KiB
YAML
# OIDC configuration for Drupal's OpenID Connect module.
|
|
|
|
# Global settings for openid_connect.settings
|
|
|
|
oidc_settings:
|
|
automatic_account_creation: true # Auto-create users on first login
|
|
always_save_userinfo: true # Store latest userinfo on each login
|
|
link_existing_users: true # Match existing users by email
|
|
login_display: "button" # 'button' or 'form'
|
|
enforced: false # If true, require login for the whole site
|
|
|
|
# OIDC client entity (e.g., 'keycloak')
|
|
|
|
oidc_client:
|
|
id: "keycloak"
|
|
label: "Keycloak"
|
|
plugin: "generic" # use the built-in generic OIDC client plugin
|
|
settings:
|
|
client_id: "{{ OIDC.CLIENT.ID }}"
|
|
client_secret: "{{ OIDC.CLIENT.SECRET }}"
|
|
authorization_endpoint: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
|
|
token_endpoint: "{{ OIDC.CLIENT.TOKEN_URL }}"
|
|
userinfo_endpoint: "{{ OIDC.CLIENT.USER_INFO_URL }}"
|
|
end_session_endpoint: "{{ OIDC.CLIENT.LOGOUT_URL }}"
|
|
scopes:
|
|
- "openid"
|
|
- "email"
|
|
- "profile"
|
|
use_standard_claims: true
|
|
# Optional claim mapping examples:
|
|
# username_claim: "{{ OIDC.ATTRIBUTES.USERNAME }}"
|
|
# email_claim: "{{ OIDC.ATTRIBUTES.EMAIL }}"
|
|
# given_name_claim: "{{ OIDC.ATTRIBUTES.GIVEN_NAME }}"
|
|
# family_name_claim: "{{ OIDC.ATTRIBUTES.FAMILY_NAME }}"
|