Crates.io | oidc_pages |
lib.rs | oidc_pages |
version | 1.0.0 |
source | src |
created_at | 2024-07-07 15:59:57.522798 |
updated_at | 2024-07-07 15:59:57.522798 |
description | Serve static HTML with OIDC for authorization and authentication. |
homepage | |
repository | https://github.com/newAM/oidc_pages |
max_upload_size | |
id | 1294976 |
size | 195,730 |
OIDC pages serves static HTML documents with OIDC for authentication and per-document authorization (permissions).
This is designed to be used with HTML generated from tools such as sphinx, doxygen, or mdbook, but works with any static HTML.
There are two assumptions that make this keycloak-specific.
resource_access
-> client ID -> roles
.Majority of OIDC providers use a JWT for the access token, the only modifications necessary should be how to obtain roles.
These features may or may not happen.
index.html
Please report vulnerabilities to my git committer email.
This is designed to be used with NixOS, but should work on any Linux OS with systemd.
You will need to bring a reverse proxy for TLS, I suggest nginx.
https://pages.company.com
https://pages.company.com
https://pages.company.com/callback
On
Off
Standard flow
(all others disabled)admin
role can view all pagesReference nixos/module.nix
for a complete list of options,
below is an example of my configuration.
{
oidc_pages,
config,
...
}: let
bindAddr = "127.0.0.1:38443";
pagesDomain = "pages.company.com";
in {
# import the module, this adds the "services.oidc_pages" options
imports = [oidc_pages.nixosModules.default];
# add the overlay, this puts "oidc_pages" into "pkgs"
nixpkgs.overlays = [oidc_pages.overlays.default];
# use nix-sops to manage secrets declaratively
# https://github.com/Mic92/sops-nix
sops.secrets.oidc_pages.mode = "0400";
# reference module for descriptions of configuration
services.oidc_pages = {
enable = true;
environmentFiles = [config.sops.secrets.oidc_pages.path];
settings = {
public_url = "https://${pagesDomain}";
issuer_url = "https://sso.company.com/realms/company";
client_id = "pages";
pages_path = "/var/www/pages";
log_level = "info";
bind_addrs = [bindAddr];
};
};
# use NGINX as a reverse proxy to provide a TLS (https) interface
networking.firewall.allowedTCPPorts = [443];
services.nginx = {
enable = true;
virtualHosts."${pagesDomain}" = {
onlySSL = true;
locations = {
"/".proxyPass = "http://${bindAddr}";
# pages are private, deny search indexing
"= /robots.txt" = {
return = ''200 "User-agent: *\nDisallow: /\n"'';
extraConfig = "add_header Content-Type text/plain;";
};
};
};
};
}