54 lines
2 KiB
YAML
54 lines
2 KiB
YAML
|
# Enhanced Role Mapping Configuration
|
||
|
|
# Much simpler and more practical than complex nested objects
|
||
|
|
|
||
|
|
oidc:
|
||
|
|
issuer: "https://sso.company.com"
|
||
|
|
client_id: "headplane"
|
||
|
|
client_secret: "your-secret"
|
||
|
|
scope: "openid email profile groups"
|
||
|
|
|
||
|
|
# Simple string arrays for role mapping (optional)
|
||
|
|
# If not specified, uses intelligent convention-based defaults
|
||
|
|
owner_groups: ["ceo", "cto", "founders", "company-owners"]
|
||
|
|
admin_groups: ["admins", "administrators", "it-admin", "platform-team"]
|
||
|
|
network_admin_groups: ["network-team", "devops", "sre", "infrastructure"]
|
||
|
|
it_admin_groups: ["helpdesk", "support-team", "it-staff"]
|
||
|
|
auditor_groups: ["compliance", "audit-team", "security"]
|
||
|
|
|
||
|
|
---
|
||
|
|
# Alternative: Environment Variables (great for containers)
|
||
|
|
# HEADPLANE_OWNER_GROUPS="ceo,cto,founders"
|
||
|
|
# HEADPLANE_ADMIN_GROUPS="admins,administrators,it-admin"
|
||
|
|
# HEADPLANE_NETWORK_ADMIN_GROUPS="network-team,devops,sre"
|
||
|
|
# HEADPLANE_IT_ADMIN_GROUPS="helpdesk,support-team"
|
||
|
|
# HEADPLANE_AUDITOR_GROUPS="compliance,audit-team,security"
|
||
|
|
|
||
|
|
---
|
||
|
|
# Convention-based defaults (no config needed!)
|
||
|
|
# These patterns work automatically with most identity providers:
|
||
|
|
#
|
||
|
|
# OWNER: ceo, cto, founder, owner, *-owner, *-owners, owner-*
|
||
|
|
# ADMIN: admin, administrator, *-admin, *-admins, admin-*, platform*, sysadmin
|
||
|
|
# NETWORK_ADMIN: network*, devops*, sre*, *infrastructure*, netadmin
|
||
|
|
# IT_ADMIN: helpdesk*, support*, it, it-*, *-it
|
||
|
|
# AUDITOR: audit*, compliance*, security*, auditor
|
||
|
|
# MEMBER: everyone else (default)
|
||
|
|
|
||
|
|
---
|
||
|
|
# Real-world examples that work out of the box:
|
||
|
|
|
||
|
|
# Google Workspace
|
||
|
|
# Groups: "ceo@company.com", "admins@company.com", "devops@company.com"
|
||
|
|
# Result: Works automatically via convention matching
|
||
|
|
|
||
|
|
# Azure AD
|
||
|
|
# Groups: "Company Owners", "IT Administrators", "Network Team"
|
||
|
|
# Result: Works automatically via convention matching
|
||
|
|
|
||
|
|
# Keycloak
|
||
|
|
# Groups: "/company/founders", "/company/platform-admins", "/teams/infrastructure"
|
||
|
|
# Result: Works automatically via convention matching
|
||
|
|
|
||
|
|
# Okta
|
||
|
|
# Groups: "COMPANY_CEO", "IT_ADMINS", "DEVOPS_TEAM"
|
||
|
|
# Result: Works automatically via convention matching
|