---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dex
  namespace: tanzu-system-auth
data:
  config.yaml: |
    issuer: https://<DEX_SVC_LB_HOSTNAME>
    frontend:
      theme: tkg
    web:
      https: 0.0.0.0:5556
      tlsCert: /etc/dex/tls/tls.crt
      tlsKey: /etc/dex/tls/tls.key
    expiry:
      signingKeys: "10m"
      idTokens: "5m"
    logger:
      level: "debug"
      format: "json"

    staticClients: []
    connectors:
    - type: oidc
      id: oidc
      name: oidc
      config:
        issuer: <OIDC_IDP_URL>
        clientID: $OIDC_CLIENT_ID
        clientSecret: $OIDC_CLIENT_SECRET
        redirectURI: https://<DEX_SVC_LB_HOSTNAME>/callback
        # Some providers require passing client_secret via POST parameters instead
        # of basic auth, despite the OAuth2 RFC discouraging it. Many of these
        # cases are caught internally, but some may need to uncomment the
        # following field.
        #
        # basicAuthUnsupported: true

        # Google supports whitelisting allowed domains when using G Suite
        # (Google Apps). The following field can be set to a list of domains
        # that can log in:
        #
        # hostedDomains:
        #  - example.com

        # List of additional scopes to request in token response
        # Default is profile and email
        # Full list at https://github.com/dexidp/dex/blob/master/Documentation/custom-scopes-claims-clients.md
        # scopes:
        #  - profile
        #  - email
        #  - groups

        # Some providers return claims without "email_verified", when they had no usage of emails verification in enrollment process
        # or if they are acting as a proxy for another IDP etc AWS Cognito with an upstream SAML IDP
        # This can be overridden with the below option
        insecureSkipEmailVerified: true

        # Groups claims (like the rest of oidc claims through dex) only refresh when the id token is refreshed
        # meaning the regular refresh flow doesn't update the groups claim. As such by default the oidc connector
        # doesn't allow groups claims. If you are okay with having potentially stale group claims you can use
        # this option to enable groups claims through the oidc connector on a per-connector basis.
        # This can be overridden with the below option
        # insecureEnableGroups: true

        # When enabled, the OpenID Connector will query the UserInfo endpoint for additional claims. UserInfo claims
        # take priority over claims returned by the IDToken. This option should be used when the IDToken doesn't contain
        # all the claims requested.
        # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
        # getUserInfo: true

        # The set claim is used as user id.
        # Default: sub
        # Claims list at https://openid.net/specs/openid-connect-core-1_0.html#Claims
        #
        # userIDKey: nickname

        # The set claim is used as user name.
        # Default: name
        # userNameKey: nickname
    oauth2:
      skipApprovalScreen: true
      responseTypes: ["code", "token", "id_token"]
    storage:
      type: kubernetes
      config:
        inCluster: true

    enablePasswordDB: false
