KanidmOAuth2Client

kaniop.rs / v1beta1

apiVersion: kaniop.rs/v1beta1 kind: KanidmOAuth2Client metadata: name: example

spec object required

The KanidmOAuth2Client custom resource definition (CRD) defines an OAuth2 client integration in Kanidm. This resource allows you to configure OAuth2 clients that can interact with the Kanidm authorization server. The CRD supports various configurations, including scope maps, claim maps, and other OAuth2 client settings. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

allowInsecureClientDisablePkce boolean

Disable PKCE on this oauth2 client to work around insecure clients that may not support it. You should request the client to enable PKCE! Public clients cannot disable PKCE. PKCE is enabled by default.

allowLocalhostRedirect boolean

Allow public clients to redirect to localhost. Just public clients can allow localhost redirect. Disabled by default.

claimMap []object

Mapping from a group to a custom claims that it provides to members.

joinStrategy string

The strategy to join the values together. Possible strategies to join the values of a claim map: `csv` -> "value_a,value_b" `ssv` -> "value_a value_b" `array` -> ["value_a", "value_b"]

enum: csv, ssv, array

name string required

The name of the claim that will be provided to the client.

valuesMap []object required

group string required

The group name or SPN that will provide the claim.

values []string required

The values that will be provided to the client.

disableConsentPrompt boolean

Disable the consent prompt for this OAuth2 client. This allows skipping the user consent screen for well-known admin-managed applications. When enabled, users will not be prompted to grant consent when authorizing with this client. Disabled by default.

displayname string required

Set the display name for the OAuth2 client.

image object

Optional URL to an image for the OAuth2 client application. The image will be downloaded and set in Kanidm for display in the application portal. Constraints: - Maximum size: 256 KB - Maximum dimensions: 1024 x 1024 pixels - Supported formats: png, jpg, gif, svg, webp

url string required

URL to fetch the image from (HTTP/HTTPS only). The operator will periodically check this URL for changes using HEAD requests and re-download the image when changes are detected.

jwtLegacyCryptoEnable boolean

Enable legacy signing crypto on this oauth2 client. This defaults to being disabled. You only need to enable this for openid clients that do not support modern cryptographic operations. Disabled by default.

kanidmName string

The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used. Use this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules (e.g., entities with underscores like `idm_admin` or `idm_all_persons`). This field is immutable and cannot be changed after creation.

kanidmRef object required

KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where the object is stored.

name string required

namespace string

For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the resource will be used.

origin string required

Set the landing page (home page) of the client. The landing page is where users will be redirected to from the Kanidm application portal.

preferShortUsername boolean

Use the 'name' attribute instead of 'spn' for the preferred_username. Disabled by default.

public boolean

Create a new OAuth2 public client that requires PKCE. You should prefer using confidential client types if possible over public ones. Public clients have many limitations and can not access all API's of OAuth2. For example rfc7662 token introspection requires client authentication. This cannot be changed after creation. Default value is false. This field is immutable. If public is false, the operator will create a secret containing the client secret with the name `<oauth2-client-name>-kanidm-oauth2-credentials` in the same namespace as the OAuth2 client.

redirectUrl []string required

Set the URL where the application expects OAuth2 requests to be sent.

scopeMap []object

Main scope map for the OAuth2 client. For an authorization to proceed, all scopes requested by the client must be available in the final scope set that is granted to the account.

group string required

Group name or SPN. Members of this group will be granted the scopes defined in the `scopes` field.

scopes []string required

A scope is a string that represents a specific permission or set of permissions that a client application can request from an authorization server. Scopes define the level of access that the client application is granted to the user's resources. OpenID Connect allows a number of scopes that affect the content of the resulting authorization token. If one of the following scopes is requested by the OpenID client, then the associated claims may be added to the authorization token. It is not guaranteed that all of the associated claims will be added. - `profile`: name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, and updated_at - `email`: email, email_verified - `address`: address - `phone`: phone_number, phone_number_verified - `groups`: groups If you are creating an OpenID Connect (OIDC) client, you MUST provide a scope map containing `openid`. Without this, OpenID Connect clients WILL NOT WORK!

secretKeyAliases object

Aliases for the canonical secret keys (CLIENT_ID and CLIENT_SECRET). Allows consumers that require different fixed key names to access the same credentials. The canonical keys CLIENT_ID and CLIENT_SECRET are always present. Only applies to confidential clients (public: false).

clientId []string

Aliases for the CLIENT_ID key. Each alias will be added as an additional key containing the same client ID value.

clientSecret []string

Aliases for the CLIENT_SECRET key. Each alias will be added as an additional key containing the same client secret value.

secretRotation object

Automatic rotation configuration for the OAuth2 client secret. Only applies to confidential clients (public: false). When enabled, the operator will regenerate the client secret periodically based on the configured rotation period.

enabled boolean

Enable automatic secret rotation. Defaults to false (opt-in).

periodDays integer

Rotation period in days. Secrets will be rotated when they are older than this period. Defaults to 90 days.

format: uint32

minimum: 0

secretTemplate object

Template applied to the Secret created for confidential clients (public: false). Allows attaching custom annotations and labels to the generated Secret. The operator's own labels and annotations take precedence over any conflicting keys in the template. Changes to this template are enforced on the next reconciliation, overwriting any manual modifications made to the Secret

annotations object

Annotations to add to the object. The operator's own annotations take precedence over any keys specified here.

labels object

Labels to add to the object. The operator's own labels take precedence over any keys specified here.

strictRedirectUrl boolean

Enable strict validation of redirect URLs. Previously redirect URLs only validated the origin of the URL matched. When enabled, redirect URLs must match exactly. Enabled by default.

supScopeMap []object

Supplementary scope maps for the OAuth2 client. These function the same as scope maps where membership of a group provides a set of scopes to the account. However these scopes are NOT consulted during authorization decisions made by Kanidm. These scopes exist to allow optional properties to be provided (such as personal information about a subset of accounts to be revealed) or so that the service may make its own authorization decisions based on the provided scopes.

group string required

Group name or SPN. Members of this group will be granted the scopes defined in the `scopes` field.

scopes []string required

status object

Most recent observed status of the Kanidm Group. Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

claimsMap []string

conditions []object

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

status string required

status of the condition, one of True, False, Unknown.

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

image object

Status of the OAuth2 client image.

contentHash string

Hash of the image content (SHA-256, for validation).

contentLength integer

Content-Length from the last fetch.

format: uint64

minimum: 0

etag string

ETag header from the last fetch (for change detection).

lastModified string

Last-Modified header from the last fetch.

url string required

The URL from which the image was last fetched.

kanidmRef string required

origin []string

ready boolean required

scopeMap []string

secretName string

supScopeMap []string

No matches. Try .spec.allowInsecureClientDisablePkce for an exact path