---
kind: ConfigMap
apiVersion: v1
metadata:
  name: dex
  namespace: kube-system
data:
  config.yaml: |
    issuer: "https://{{ pillar['api']['server']['external_fqdn'] }}:{{ pillar['dex']['node_port'] }}"
    storage:
      type: kubernetes
      config:
        inCluster: true
    web:
      https: 0.0.0.0:5556
      tlsCert: /etc/dex/tls/dex.crt
      tlsKey: /etc/dex/tls/dex.key
    frontend:
      dir: /usr/share/caasp-dex/web
      theme: caasp
    connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: "{{ pillar['dashboard'] }}:389"
        startTLS: true
        bindDN: "{{ pillar['ldap']['bind_dn'] }}"
        bindPW: "{{ pillar['ldap']['bind_pw'] }}"
        rootCA: {{ pillar['ssl']['ca_file'] }}
        userSearch:
          baseDN: "{{ pillar['ldap']['people_dn'] }}"
          filter: "(objectClass=inetOrgPerson)"
          username: "{{ pillar['ldap']['mail_attribute'] }}"
          idAttr: DN
          emailAttr: "{{ pillar['ldap']['mail_attribute'] }}"
          nameAttr: cn
        groupSearch:
          baseDN: "{{ pillar['ldap']['group_dn'] }}"
          filter: "(objectClass=groupOfUniqueNames)"

          userAttr: DN
          groupAttr: uniqueMember

          nameAttr: cn
    {% for con in salt['pillar.get']('dex:connectors', []) %}
    {% if con['type'] == 'ldap' %}
    - type: ldap
      id: {{ con['id'] | yaml_dquote }}
      name: {{ con['name'] | yaml_dquote }}
      config:
        host: {{ con['server'] | yaml_dquote }}
        startTLS: {{ 'true' if con.get('start_tls',false) else 'false' }}
        {% if con['bind']['anonymous'] %}
        # bindDN and bindPW not present; anonymous bind will be used
        {% else %}
        bindDN: {{ con['bind']['dn'] | yaml_dquote }}
        bindPW: {{ con['bind']['pw'] | yaml_dquote }}
        {% endif %}
        usernamePrompt: {{ con['username_prompt'] | yaml_dquote }}
        rootCAData: {{ con['root_ca_data'] | replace("\n","") | yaml_dquote }}
        userSearch:
          baseDN: {{ con['user']['base_dn'] | yaml_dquote }}
          filter: {{ con['user']['filter'] | yaml_dquote }}
          username: {{ con['user']['attr_map']['username'] | yaml_dquote }}
          idAttr: {{ con['user']['attr_map']['id'] | yaml_dquote }}
          emailAttr: {{ con['user']['attr_map']['email'] | yaml_dquote }}
          nameAttr: {{ con['user']['attr_map']['name'] | yaml_dquote }}
        groupSearch:
          baseDN: {{ con['group']['base_dn'] | yaml_dquote }}
          filter: {{ con['group']['filter'] | yaml_dquote }}

          userAttr: {{ con['group']['attr_map']['user'] | yaml_dquote }}
          groupAttr: {{ con['group']['attr_map']['group'] | yaml_dquote }}

          nameAttr: {{ con['group']['attr_map']['name'] | yaml_dquote }}
    {% endif %}
    {% if con['type'] == 'oidc' %}
    - type: oidc
      id: {{ con['id'] | yaml_dquote }}
      name: {{ con['name'] | yaml_dquote }}
      config:
        issuer: {{ con['provider_url'] | yaml_dquote }}
        clientID: {{ con['client_id'] | yaml_dquote }}
        clientSecret: {{ con['client_secret'] | yaml_dquote }}
        basicAuthUnsupported: {{ 'false' if con.get('basic_auth',false) else 'true' }}
        redirectURI: {{ con['callback_url'] | yaml_dquote }}
    {% endif %}
    {% endfor %}
    oauth2:
      skipApprovalScreen: true

    staticClients:
    - id: kubernetes
      redirectURIs:
      - 'urn:ietf:wg:oauth:2.0:oob'
      name: "Kubernetes"
      secret: "{{ pillar['dex']['client_secrets']['kubernetes'] }}"
      trustedPeers:
      - caasp-cli
      - velum

    - id: caasp-cli
      redirectURIs:
      - 'urn:ietf:wg:oauth:2.0:oob'
      - 'http://127.0.0.1'
      - 'http://localhost'
      name: "CaaSP CLI"
      secret: "swac7qakes7AvucH8bRucucH"
      public: true

    - id: velum
      redirectURIs:
      - 'https://{{ pillar['dashboard'] }}/oidc/done'
      - 'https://{{ pillar['dashboard_external_fqdn'] }}/oidc/done'
      name: "Velum"
      secret: "{{ pillar['dex']['client_secrets']['velum'] }}"
