Initial commit

2026-08-21 05:26:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,63 @@
+---
+# Ceph Dashboard SAML2 Provider Blueprint for Authentik
+# Creates a SAML2 provider for Ceph Dashboard native SSO
+# Ceph expects:
+#   - Audience: https://ceph.kube.huskypup.net/auth/saml2/metadata
+#   - ACS URL: https://ceph.kube.huskypup.net/auth/saml2
+#   - Username attribute: "username"
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprints-ceph
+  namespace: authentik
+  labels:
+    goauthentik.io/blueprint: "true"
+data:
+  ceph.yaml: |-
+    version: 1
+    metadata:
+      name: ceph-dashboard-saml
+    entries:
+      # SAML Property Mapping for username attribute (required by Ceph)
+      - model: authentik_providers_saml.samlpropertymapping
+        id: ceph-username-mapping
+        state: present
+        identifiers:
+          managed: goauthentik.io/providers/saml/ceph-username
+        attrs:
+          name: "Ceph Dashboard SAML: Username"
+          saml_name: "username"
+          expression: "return request.user.username"
+
+      # SAML2 Provider for Ceph Dashboard
+      - model: authentik_providers_saml.samlprovider
+        id: ceph-dashboard-saml-provider
+        state: present
+        identifiers:
+          name: ceph-dashboard-saml
+        attrs:
+          name: ceph-dashboard-saml
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          acs_url: "https://ceph.kube.huskypup.net/auth/saml2"
+          audience: "https://ceph.kube.huskypup.net/auth/saml2/metadata"
+          sp_binding: post
+          default_name_id_policy: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          sign_response: true
+          sign_assertion: true
+          property_mappings:
+            - !KeyOf ceph-username-mapping
+
+      # Application entry
+      - model: authentik_core.application
+        id: ceph-dashboard-application
+        state: present
+        identifiers:
+          slug: ceph-dashboard
+        attrs:
+          name: Ceph Dashboard
+          slug: ceph-dashboard
+          policy_engine_mode: any
+          provider: !KeyOf ceph-dashboard-saml-provider
+          meta_launch_url: "https://ceph.kube.huskypup.net"