config

type Identities struct {
	// contains filtered or unexported fields
}

type Identity struct {
	Title   string   `json:"title,omitempty"`
	ID      string   `json:"id,omitempty"`
	Secrets []Secret `json:"secrets,omitempty"`
	Zones   []string `json:"zones,omitempty"`
	Roles   []string `json:"roles,omitempty"`
}

type Keycloak struct {
	URL      string `json:"url,omitempty"`
	Realm    string `json:"realm,omitempty"`
	ClientID string `json:"clientID,omitempty"`
}

type Root struct {
	system.Config
	// User configures user credential and access token validation for applications acting on behalf of a user.
	// This includes the ability to login using a username and password through OIDC authentication servers like KeyCloak.
	User *User `json:"user,omitempty"`
	// System configures credential and access token validation for applications acting on their own behalf.
	// This includes OAuth2 Client Credentials key exchange and validation backed by different key stores.
	System *System `json:"system,omitempty"`
}

type Secret struct {
	Note string `json:"note,omitempty"`
	Hash string `json:"hash,omitempty"`
}

type System struct {
	// Validity defaults to 15 minutes and specifies how long access tokens generated by client credentials key exchange are valid for.
	Validity *jsontypes.Duration `json:"validity,omitempty"`

	// FileAccounts, when non-nil, causes the system to validate system tokens using a local
	// file of identities and secrets.
	// See Identities for how this field can be represented/configured in JSON.
	FileAccounts *Identities `json:"fileAccounts,omitempty"`
	// TenantAccounts causes the system to validate system tokens using the tenants system.
	// All tokens are deemed invalid if the tenants system is not available.
	TenantAccounts bool `json:"tenantAccounts,omitempty"`
	// CohortAccounts causes the system to validate system tokens using the cohort manager, setup via enrollment.
	// All tokens are deemed invalid if the manager is not known (i.e. the controller is not enrolled), or the manager doesn't support TenantApi.
	CohortAccounts bool `json:"cohortAccounts,omitempty"`
}

type User struct {
	// Validity defaults to 24 hours and specifies how long access tokens generated by user key exchange are valid for.
	Validity *jsontypes.Duration `json:"validity,omitempty"`

	// FileAccounts enumerates a list of identities that incoming credentials are validated against.
	FileAccounts *Identities `json:"fileAccounts,omitempty"`
	// Keycloak configures access token validation against a KeyCloak server using OIDC.
	Keycloak *keycloak.Config `json:"keycloakAccounts,omitempty"`
}