System CLI: Updated to 126de5599c state

[bookstack] / app / Config / oidc.php

diff --git a/app/Config/oidc.php b/app/Config/oidc.php
index 43e8678adc7313e7f70933e43dd602400e1e2f56..8b5470931d08379431c8f3b420f02aa7356c87b1 100644 (file)
--- a/app/Config/oidc.php
+++ b/app/Config/oidc.php
@@ -8,8 +8,11 @@ return [
     // Dump user details after a login request for debugging purposes
     'dump_user_details' => env('OIDC_DUMP_USER_DETAILS', false),
 
     // Dump user details after a login request for debugging purposes
     'dump_user_details' => env('OIDC_DUMP_USER_DETAILS', false),
 

-    // Attribute, within a OpenId token, to find the user's display name
-    'display_name_claims' => explode('|', env('OIDC_DISPLAY_NAME_CLAIMS', 'name')),
+    // Claim, within an OpenId token, to find the user's display name
+    'display_name_claims' => env('OIDC_DISPLAY_NAME_CLAIMS', 'name'),
+
+    // Claim, within an OpenID token, to use to connect a BookStack user to the OIDC user.
+    'external_id_claim' => env('OIDC_EXTERNAL_ID_CLAIM', 'sub'),

 
     // OAuth2/OpenId client id, as configured in your Authorization server.
     'client_id' => env('OIDC_CLIENT_ID', null),
 
     // OAuth2/OpenId client id, as configured in your Authorization server.
     'client_id' => env('OIDC_CLIENT_ID', null),


@@ -17,14 +20,38 @@ return [
     // OAuth2/OpenId client secret, as configured in your Authorization server.
     'client_secret' => env('OIDC_CLIENT_SECRET', null),
 
     // OAuth2/OpenId client secret, as configured in your Authorization server.
     'client_secret' => env('OIDC_CLIENT_SECRET', null),
 

-    // The issuer of the identity token (id_token) this will be compared with what is returned in the token.
+    // The issuer of the identity token (id_token) this will be compared with
+    // what is returned in the token.

     'issuer' => env('OIDC_ISSUER', null),
 
     'issuer' => env('OIDC_ISSUER', null),
 

+    // Auto-discover the relevant endpoints and keys from the issuer.
+    // Fetched details are cached for 15 minutes.
+    'discover' => env('OIDC_ISSUER_DISCOVER', false),
+

     // Public key that's used to verify the JWT token with.
     // Can be the key value itself or a local 'file://public.key' reference.
     'jwt_public_key' => env('OIDC_PUBLIC_KEY', null),
 
     // OAuth2 endpoints.
     'authorization_endpoint' => env('OIDC_AUTH_ENDPOINT', null),
     // Public key that's used to verify the JWT token with.
     // Can be the key value itself or a local 'file://public.key' reference.
     'jwt_public_key' => env('OIDC_PUBLIC_KEY', null),
 
     // OAuth2 endpoints.
     'authorization_endpoint' => env('OIDC_AUTH_ENDPOINT', null),

-    'token_endpoint' => env('OIDC_TOKEN_ENDPOINT', null),
+    'token_endpoint'         => env('OIDC_TOKEN_ENDPOINT', null),
+    'userinfo_endpoint'      => env('OIDC_USERINFO_ENDPOINT', null),
+
+    // OIDC RP-Initiated Logout endpoint URL.
+    // A false value force-disables RP-Initiated Logout.
+    // A true value gets the URL from discovery, if active.
+    // A string value is used as the URL.
+    'end_session_endpoint' => env('OIDC_END_SESSION_ENDPOINT', false),
+
+    // Add extra scopes, upon those required, to the OIDC authentication request
+    // Multiple values can be provided comma seperated.
+    'additional_scopes' => env('OIDC_ADDITIONAL_SCOPES', null),
+
+    // Group sync options
+    // Enable syncing, upon login, of OIDC groups to BookStack roles
+    'user_to_groups' => env('OIDC_USER_TO_GROUPS', false),
+    // Attribute, within a OIDC ID token, to find group names within
+    'groups_claim' => env('OIDC_GROUPS_CLAIM', 'groups'),
+    // When syncing groups, remove any groups that no longer match. Otherwise, sync only adds new groups.
+    'remove_from_groups' => env('OIDC_REMOVE_FROM_GROUPS', false),

 ];
 ];