feat(authelia): description of custom claims

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/auth/authelia/kustomization.yaml

@@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: authelia
 
+configMapGenerator:
+  - name: consent
+    namespace: authelia
+    files:
+      - ./locales/en/consent.json
+
 resources:
   - ns.yaml
   - crypto.yaml

k8s/infra/auth/authelia/locales/en/consent.json

@@ -0,0 +1,62 @@
+{
+  "Accept this consent request": "Accept this consent request",
+  "An error occurred processing the request": "An error occurred processing the request",
+  "Claim": "Claim {{name}}",
+  "Client ID": "Client ID: {{client_id}}",
+  "Code": "Code",
+  "Confirm the Code": "Confirm the Code",
+  "Consent has been accepted and processed": "Consent has been accepted and processed",
+  "Consent has been rejected and processed": "Consent has been rejected and processed",
+  "Consent Request": "Consent Request",
+  "Debug Information": "Debug Information",
+  "Deny this consent request": "Deny this consent request",
+  "Description": "Description",
+  "Documentation": "Documentation",
+  "Error": "Error",
+  "Error Code": "Error Code",
+  "Failed to submit the user code": "Failed to submit the user code",
+  "Hint": "Hint",
+  "Remember Consent": "Remember Consent",
+  "Scope": "Scope {{name}}",
+  "The above application is requesting the following permissions": "The above application is requesting the following permissions",
+  "This saves this consent as a pre-configured consent for future use": "This saves this consent as a pre-configured consent for future use",
+  "You may close this tab or return home by clicking the home button": "You may close this tab or return home by clicking the home button",
+  "You must reauthenticate to be able to give consent": "You must reauthenticate to be able to give consent",
+  "claims": {
+    "address": "Postal Address",
+    "birthdate": "Birthdate",
+    "email": "E-mail Address",
+    "email_verified": "E-mail Address (Verified)",
+    "family_name": "Family Name",
+    "gender": "Gender",
+    "given_name": "Given Name",
+    "groups": "Group Membership",
+    "locale": "Locale / Language",
+    "middle_name": "Middle Name",
+    "name": "Display Name",
+    "nickname": "Nickname",
+    "phone_number": "Phone Number",
+    "phone_number_verified": "Phone Number (Verified)",
+    "picture": "Picture URL",
+    "preferred_username": "Preferred Username",
+    "profile": "Profile URL",
+    "sub": "Unique Identifier",
+    "updated_at": "Profile Update Time",
+    "website": "Website URL",
+    "zoneinfo": "Timezone",
+    "argocd": "Argo CD permissions",
+    "audiobookshelf": "Audiobookshelf permissions"
+  },
+  "scopes": {
+    "address": "Access your address",
+    "authelia.bearer.authz": "Access protected resources logged in as you",
+    "email": "Access your email addresses",
+    "groups": "Access your group memberships",
+    "offline_access": "Automatically refresh these permissions without user interaction",
+    "openid": "Use OpenID to verify your identity",
+    "phone": "Access your phone number",
+    "profile": "Access your profile information",
+    "argocd": "Argo CD",
+    "audiobookshelf": "Audiobookshelf"
+  }
+}

k8s/infra/auth/authelia/values.yaml

@@ -10,6 +10,15 @@ pod:
   env:
     - name: TZ
       value: Europe/Oslo
+  extraVolumeMounts:
+    - name: consent
+      mountPath: /config/assets/locales/en/consent.json
+      subPath: consent.json
+  extraVolumes:
+    - name: consent
+      configMap:
+        defaultMode: 0644
+        name: consent
 
 configMap:
   default_2fa_method: totp
@@ -26,6 +35,9 @@ configMap:
   session:
     cookies: [ { domain: stonegarden.dev } ]
 
+  server:
+    asset_path: /config/assets/
+
   storage:
     postgres:
       enabled: true
@@ -100,6 +112,7 @@ configMap:
           authorization_policy: two_factor
           claims_policy: argocd
           pre_configured_consent_duration: 1 month
+          require_pkce: true
           redirect_uris:
             - https://argocd.stonegarden.dev/auth/callback
             - https://argocd.stonegarden.dev/applications

k8s/infra/controllers/argocd/values.yaml

@@ -13,12 +13,13 @@ configs:
       clientID: 'argocd'
       clientSecret: $oidc:authelia.clientSecret
       cliClientID: 'argocd-cli'
-      requestedScopes: [ 'openid', 'profile', 'email', 'offline_access', 'argocd' ]
+      requestedScopes: [ 'openid' ]
       enableUserInfoGroups: true
       requestedIDTokenClaims: 
         argocd: { essential: true }
-        profile: { essential: false }
         email: { essential: false }
+        name: { essential: false }
+        preferred_username: { essential: false }
         offline_access: { essential: false }
       userInfoPath: /api/oidc/userinfo
       userInfoCacheExpiration: '5m'