Skip to content

Commit 6953954

Browse files
SkylordASkylordA
authored
Merge pull request #49 from OasisLMF/feature/oidc_auth
feature/oidc_auth
2 parents 7af1d03 + fdd6708 commit 6953954

36 files changed

Lines changed: 4866 additions & 230 deletions

‎.env‎

Lines changed: 103 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,105 @@
1+
# ============================================================================
2+
# KEYCLOAK OIDC AUTHENTICATION CONFIGURATION
3+
# ============================================================================
4+
# Uses Keycloak as the identity provider for OIDC authentication
5+
# Keycloak Admin: http://localhost:8080/auth/admin (keycloak / password)
6+
7+
# Project Configuration
8+
COMPOSE_PROJECT_NAME=oasispythonui
9+
OASIS_DEBUG=1
10+
11+
# Docker socket path (Docker Desktop uses ~/.docker/desktop/docker.sock)
12+
# Standard Docker: /var/run/docker.sock
13+
DOCKER_SOCK=/var/run/docker.sock
14+
15+
# Hostname Configuration
16+
OASIS_UI_HOSTNAME=ui.oasis.local
17+
OASIS_PROTOCOL=http
18+
19+
# Authentication Type
20+
API_AUTH_TYPE=keycloak
21+
OASIS_SERVER_ALLOWED_OIDC_AUTH_PROVIDERS=keycloak,authentik
22+
23+
# Image Versions
124
SERVER_IMG=coreoasis/api_server
25+
VERS_API=2.5
226
WORKER_IMG=coreoasis/model_worker
3-
SCENARIOS_UI_IMG=coreoasis/oasis_scenarios
4-
SCENARIOS_PATH=../Scenarios
27+
VERS_WORKER=2.5
28+
PYTHONUI_IMG=coreoasis/oasispythonui_app
29+
VERS_UI=latest
30+
VERS_PIWIND=stable/2.5.x
31+
32+
# Database Configuration
33+
OASIS_SERVER_DB_HOST=server-db
34+
OASIS_SERVER_DB_PORT=5432
35+
OASIS_SERVER_DB_NAME=oasis
36+
OASIS_SERVER_DB_USER=oasis
37+
OASIS_SERVER_DB_PASS=oasis
38+
39+
OASIS_CELERY_DB_HOST=celery-db
40+
OASIS_CELERY_DB_PORT=5432
41+
OASIS_CELERY_DB_NAME=celery
42+
OASIS_CELERY_DB_USER=celery
43+
OASIS_CELERY_DB_PASS=password
44+
45+
# Broker & Channel Layer
46+
RABBITMQ_DEFAULT_USER=rabbit
47+
RABBITMQ_DEFAULT_PASS=rabbit
48+
OASIS_CELERY_BROKER_URL=amqp://rabbit:rabbit@broker:5672
49+
REDIS_HOST=channel-layer
50+
REDIS_PORT=6379
51+
OASIS_SERVER_CHANNEL_LAYER_SSL=false
52+
53+
# ============================================================================
54+
# KEYCLOAK CONFIGURATION
55+
# ============================================================================
56+
57+
# Keycloak Service
58+
KEYCLOAK_HOST=keycloak
59+
KEYCLOAK_PORT=8080
60+
61+
# Keycloak Admin Console Credentials
62+
KEYCLOAK_ADMIN_USER=keycloak
63+
KEYCLOAK_ADMIN_PASSWORD=password
64+
65+
# Keycloak Database
66+
KEYCLOAK_DB_NAME=keycloak
67+
KEYCLOAK_DB_USER=keycloak
68+
KEYCLOAK_DB_PASSWORD=password
69+
70+
# OIDC Client Configuration
71+
# These match the realm configuration in oidc/keycloak/oasis-realm.json.template
72+
OIDC_KEYCLOAK_CLIENT_NAME=oasis-server
73+
OIDC_KEYCLOAK_CLIENT_SECRET=e4f4fb25-2250-4210-a7d6-9b16c3d2ab77
74+
75+
# Service Account Client (for service-to-service auth)
76+
OASIS_SERVICE_CLIENT_NAME=oasis-service
77+
OASIS_SERVICE_CLIENT_SECRET=serviceNotSoSecret
78+
79+
# Advanced Configuration
80+
OASIS_PORTFOLIO_UPLOAD_VALIDATION=0
81+
OASIS_OASISLMF_VERSION=
82+
OASIS_ODS_VERSION=
83+
OASIS_ODM_VERSION=
84+
OASIS_OED_SCHEMA_INFO=
85+
86+
# ============================================================================
87+
# User Configuration:
88+
# - Default users defined in: oidc/keycloak/users.yaml
89+
# - Edit that file to add/modify users
90+
# - Users: admin (admin), user (non-admin)
91+
#
92+
# Quick Start:
93+
# 1. cp .env.keycloak .env
94+
# 2. ./install.sh
95+
# 3. Wait for Keycloak to start (can take 2-3 minutes first time)
96+
# 4. Access Keycloak Admin: http://localhost:8080/auth/admin
97+
# 5. Access UI: http://localhost:8501
98+
# 6. Login via Keycloak
99+
#
100+
# OIDC Endpoints (routed through traefik on port 80):
101+
# - Authorization: http://localhost/auth/realms/oasis/protocol/openid-connect/auth
102+
# - Token: http://localhost/auth/realms/oasis/protocol/openid-connect/token
103+
# - UserInfo: http://localhost/auth/realms/oasis/protocol/openid-connect/userinfo
104+
# - Keycloak Admin (direct): http://localhost:8080/auth/admin
105+
# ============================================================================

‎.env.authentik‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# ============================================================================
2+
# AUTHENTIK OIDC AUTHENTICATION CONFIGURATION
3+
# ============================================================================
4+
# Uses Authentik as the identity provider for OIDC authentication
5+
# Authentik Admin: http://localhost:9000/authentik/ (akadmin / password)
6+
7+
# Project Configuration
8+
COMPOSE_PROJECT_NAME=oasispythonui
9+
OASIS_DEBUG=1
10+
11+
# Docker socket path (Docker Desktop uses ~/.docker/desktop/docker.sock)
12+
# Standard Docker: /var/run/docker.sock
13+
DOCKER_SOCK=/var/run/docker.sock
14+
15+
# Hostname Configuration
16+
OASIS_UI_HOSTNAME=ui.oasis.local
17+
OASIS_PROTOCOL=http
18+
19+
# Authentication Type
20+
API_AUTH_TYPE=authentik
21+
OASIS_SERVER_ALLOWED_OIDC_AUTH_PROVIDERS=keycloak,authentik
22+
23+
# Image Versions
24+
SERVER_IMG=coreoasis/api_server
25+
VERS_API=2.5
26+
WORKER_IMG=coreoasis/model_worker
27+
VERS_WORKER=2.5
28+
PYTHONUI_IMG=coreoasis/oasispythonui_app
29+
VERS_UI=latest
30+
VERS_PIWIND=stable/2.5.x
31+
32+
# Database Configuration
33+
OASIS_SERVER_DB_HOST=server-db
34+
OASIS_SERVER_DB_PORT=5432
35+
OASIS_SERVER_DB_NAME=oasis
36+
OASIS_SERVER_DB_USER=oasis
37+
OASIS_SERVER_DB_PASS=oasis
38+
39+
OASIS_CELERY_DB_HOST=celery-db
40+
OASIS_CELERY_DB_PORT=5432
41+
OASIS_CELERY_DB_NAME=celery
42+
OASIS_CELERY_DB_USER=celery
43+
OASIS_CELERY_DB_PASS=password
44+
45+
# Broker & Channel Layer
46+
RABBITMQ_DEFAULT_USER=rabbit
47+
RABBITMQ_DEFAULT_PASS=rabbit
48+
OASIS_CELERY_BROKER_URL=amqp://rabbit:rabbit@broker:5672
49+
REDIS_HOST=channel-layer
50+
REDIS_PORT=6379
51+
OASIS_SERVER_CHANNEL_LAYER_SSL=false
52+
53+
# ============================================================================
54+
# AUTHENTIK CONFIGURATION
55+
# ============================================================================
56+
57+
# Authentik Service
58+
AUTHENTIK_HOST=authentik
59+
AUTHENTIK_PORT=9000
60+
61+
# Authentik Bootstrap Configuration (initial setup)
62+
AUTHENTIK_BOOTSTRAP_USER=akadmin
63+
AUTHENTIK_BOOTSTRAP_EMAIL=akadmin@example.com
64+
AUTHENTIK_BOOTSTRAP_PASSWORD=password
65+
AUTHENTIK_BOOTSTRAP_TOKEN=my-demo-token-abc123
66+
67+
# Authentik Secret Key (for encryption)
68+
# CHANGE THIS IN PRODUCTION!
69+
AUTHENTIK_SECRET_KEY=notsosecretkey
70+
71+
# Authentik Database
72+
AUTHENTIK_DB_NAME=authentik
73+
AUTHENTIK_DB_USER=authentik
74+
AUTHENTIK_DB_PASSWORD=password
75+
76+
# OIDC Client Configuration
77+
# These match the blueprint configuration in oidc/authentik/oasis-blueprint.yaml.template
78+
OIDC_AUTHENTIK_CLIENT_NAME=oasis-server
79+
OIDC_AUTHENTIK_CLIENT_SECRET=EfNMUM3GG1bd1CYUvNfiBGWKfvbGFiNAdutEqHSarZ9H7oL0sZfKLvPT1ujaqVm2839Vka8Ky0elliMQ6yWKN8Jv8dzh3BeVFn0F7LPquGkIus6JJ9nGH1vtfCt7AhtO
80+
81+
# Service Account Client (for service-to-service auth)
82+
OASIS_SERVICE_CLIENT_NAME=oasis-service
83+
OASIS_SERVICE_CLIENT_SECRET=serviceNotSoSecret
84+
85+
# Advanced Configuration
86+
OASIS_PORTFOLIO_UPLOAD_VALIDATION=0
87+
OASIS_OASISLMF_VERSION=
88+
OASIS_ODS_VERSION=
89+
OASIS_ODM_VERSION=
90+
OASIS_OED_SCHEMA_INFO=
91+
92+
# ============================================================================
93+
# User Configuration:
94+
# - Default users defined in: oidc/authentik/users.yaml
95+
# - Edit that file to add/modify users
96+
# - Users: admin (admin), user (non-admin)
97+
#
98+
# Quick Start:
99+
# 1. cp .env.authentik .env
100+
# 2. ./install.sh
101+
# 3. Wait for Authentik to start (can take 2-3 minutes first time)
102+
# 4. Access Authentik Admin: http://localhost:9000/authentik/
103+
# 5. Access UI: http://localhost:8501
104+
# 6. Login via Authentik
105+
#
106+
# OIDC Endpoints (routed through traefik on port 80):
107+
# - Authorization: http://localhost/authentik/application/o/authorize/
108+
# - Token: http://localhost/authentik/application/o/token/
109+
# - UserInfo: http://localhost/authentik/application/o/userinfo/
110+
# - Authentik Admin (direct): http://localhost:9000/authentik/
111+
#
112+
# Security Notes:
113+
# - AUTHENTIK_SECRET_KEY must be changed in production!
114+
# - This key is used for encrypting sensitive data
115+
# - Generate a secure random key for production use
116+
# ============================================================================

0 commit comments

Comments
 (0)