diff --git a/backend/modules/auth/oidc.js b/backend/modules/auth/oidc.js index f2bbeb4..4cbac6b 100644 --- a/backend/modules/auth/oidc.js +++ b/backend/modules/auth/oidc.js @@ -7,7 +7,7 @@ const key = 'oidc'; export function getModuleConfig() { const config = getConfig(); return { - title: 'FedID', + title: process.env.OIDC_BUTTON_LABEL || 'FedID', icon: 'login', issuer: process.env.OIDC_ISSUER, authorizationURL: process.env.OIDC_AUTHORIZATION_URL, diff --git a/docker-compose-dex.yml b/docker-compose-dex.yml new file mode 100644 index 0000000..4ce93e7 --- /dev/null +++ b/docker-compose-dex.yml @@ -0,0 +1,159 @@ +services: + + jlinc-server: + image: jlinclabs/jlinc-server + container_name: jlinc-server + environment: + # BASE CONFIGURATION + # ================== + # If you wish to display debug logging + # DEBUG: "true" + # + # DB URL + POSTGRES_URL: postgresql://jlinc:password@jlinc-db/jlinc + # Public URLs, callback URLS will be PUBLIC_CALLBACK_URL + '/callback/' + PUBLIC_CORE_URL: http://localhost:9090 + PUBLIC_ARCHIVE_URL: http://localhost:9090 + PUBLIC_CALLBACK_URL: http://localhost:9090 + # Enabled app modules (dashboard = the read-only operator console) + APP_MODULES: core, archive, dashboard + # Optional: source dashboard data from remote core/audit servers instead of + # the local DB (federation). Unset => serve from the local DB. + # DASHBOARD_CORE_URL: https://core.example.com + # DASHBOARD_CORE_KEY: + # DASHBOARD_AUDIT_URL: https://api.jlinc.io + # DASHBOARD_AUDIT_KEY: + # Validated-API-key cache (per process). TTL 0 disables caching entirely; + # MAX bounds how many validated keys are held before the least recently + # used is evicted. Defaults: 30 min / 10000 entries. + # DASHBOARD_KEY_CACHE_TTL_MS: 1800000 + # DASHBOARD_KEY_CACHE_MAX: 10000 + # Enabled authentication modules + AUTH_MODULES: oidc + # Secure secret for memory store, generate with `openssl rand -hex 64` + SECURE_SECRET: 9ed678e6da3333a53c635039a5f53015ba3d4c841a0ade4e46f31c2d42c9b3e71edcdda7e1d75d066a39a8f56f9eb325d556a90195c6e7f45c6e2fffd0e98a7a + # Default FedID server to use for identity management + DEFAULT_FEDID_URL: https://fedid-test.jlinc.io + + # AUTH MODULES + # ============ + + # Single User + # ----------- + # Use for local development to auto-create a test user + # SINGLE_API_KEY_CORE: OGExYWE2ZjMwYjdhZjQyZWE4MmE1YTUwO + # SINGLE_API_KEY_ARCHIVE: MDY5ZDMyZjMyZDAzYTU0ZDQwZWJiM2I4M + + # OpenID Connect + # -------------- + # Works with any OIDC provider + OIDC_BUTTON_LABEL: Local Login + OIDC_CLIENT_ID: jlinc-server + OIDC_CLIENT_SECRET: MDA1NThmZjBjNjM2ZDg5MzkwOTRkYWE0Z + OIDC_ISSUER: http://localhost:9092/dex + OIDC_AUTHORIZATION_URL: http://localhost:9092/dex/auth + OIDC_TOKEN_URL: http://localhost:9092/dex/token + OIDC_USERINFO_URL: http://localhost:9092/dex/userinfo + OIDC_LOGOUT_URL: http://localhost:9092/dex/logout + + # GitHub + # -------------- + # Set up your GitHub app: https://github.com/settings/applications/new + # GITHUB_CLIENT_ID: + # GITHUB_CLIENT_SECRET: + + # Google + # -------------- + # Set up your Google app: https://console.developers.google.com/ + # - Create a new app + # - Set up auth: https://console.cloud.google.com/auth/overview + # GOOGLE_CLIENT_ID: + # GOOGLE_CLIENT_SECRET: + + # PDP MODULES + # =========== + PDP_TYPE: cerbos + + # Cerbos + # ----------- + PDP_URL: http://jlinc-pdp:3592 + restart: unless-stopped + depends_on: + - jlinc-db + networks: + - jlinc + # White-label: mount a custom.css to re-skin the dashboard (see custom.example.css) + # volumes: + # - ./custom.example.css:/app/http/public/custom.css:ro + # For dev + ports: + - 9090:9090 + - 9092:9092 + + jlinc-db: + image: postgres:17-alpine + container_name: jlinc-db + environment: + - POSTGRES_USER=jlinc + - POSTGRES_PASSWORD=password + - POSTGRES_DB=jlinc + ports: + - 127.0.0.1:5432:5432 + volumes: + - ./data/db:/var/lib/postgresql/data + restart: unless-stopped + networks: + - jlinc + + jlinc-pdp: + image: cerbos/cerbos:0.47.0 + container_name: jlinc-pdp + ports: + - 127.0.0.1:3592:3592 + volumes: + - ./policies:/policies + restart: unless-stopped + networks: + - jlinc + + jlinc-idp: + image: dexidp/dex + container_name: jlinc-idp + command: dex serve /dex.yml + configs: + - source: dex_config + target: /dex.yml + environment: + DEX_SESSIONS_ENABLED: true + network_mode: "service:jlinc-server" + +networks: + jlinc: + +configs: + dex_config: + content: | + issuer: http://localhost:9092/dex + storage: + type: memory + web: + http: 0.0.0.0:9092 + sessions: + cookieName: "dex_session" + absoluteLifetime: "24h" + validIfNotUsedFor: "1h" + staticClients: + - id: jlinc-server + redirectURIs: + - 'http://localhost:9090/callback/oidc' + name: 'JLINC Server' + secret: MDA1NThmZjBjNjM2ZDg5MzkwOTRkYWE0Z + enablePasswordDB: true + staticPasswords: + - email: "testuser@jlinc-test.com" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + username: "testuser" + name: "Test User" + emailVerified: true + preferredUsername: "testuser" + userID: "testuser" diff --git a/docker-compose.yml b/docker-compose.yml index a661582..a20df84 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -47,6 +47,7 @@ services: # OpenID Connect # -------------- # Works with any OIDC provider + # OIDC_BUTTON_LABEL: FedID # OIDC_CLIENT_ID: # OIDC_CLIENT_SECRET: # OIDC_ISSUER: https://fedid-test.jlinc.io/oidc