---
# Ceph Dashboard SAML2 Provider Blueprint for Authentik
# Creates a SAML2 provider for Ceph Dashboard native SSO
# Ceph expects:
#   - Audience: https://ceph.kube.huskypup.net/auth/saml2/metadata
#   - ACS URL: https://ceph.kube.huskypup.net/auth/saml2
#   - Username attribute: "username"
apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-blueprints-ceph
  namespace: authentik
  labels:
    goauthentik.io/blueprint: "true"
data:
  ceph.yaml: |-
    version: 1
    metadata:
      name: ceph-dashboard-saml
    entries:
      # SAML Property Mapping for username attribute (required by Ceph)
      - model: authentik_providers_saml.samlpropertymapping
        id: ceph-username-mapping
        state: present
        identifiers:
          managed: goauthentik.io/providers/saml/ceph-username
        attrs:
          name: "Ceph Dashboard SAML: Username"
          saml_name: "username"
          expression: "return request.user.username"

      # SAML2 Provider for Ceph Dashboard
      - model: authentik_providers_saml.samlprovider
        id: ceph-dashboard-saml-provider
        state: present
        identifiers:
          name: ceph-dashboard-saml
        attrs:
          name: ceph-dashboard-saml
          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          acs_url: "https://ceph.kube.huskypup.net/auth/saml2"
          audience: "https://ceph.kube.huskypup.net/auth/saml2/metadata"
          sp_binding: post
          default_name_id_policy: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
          signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
          sign_response: true
          sign_assertion: true
          property_mappings:
            - !KeyOf ceph-username-mapping

      # Application entry
      - model: authentik_core.application
        id: ceph-dashboard-application
        state: present
        identifiers:
          slug: ceph-dashboard
        attrs:
          name: Ceph Dashboard
          slug: ceph-dashboard
          policy_engine_mode: any
          provider: !KeyOf ceph-dashboard-saml-provider
          meta_launch_url: "https://ceph.kube.huskypup.net"