docs/content/integration/openid-connect/clients/gravitee/index.md
{{% oidc-common %}}
This example makes the following assumptions:
https://gravitee.{{< sitevar name="domain" nojs="example.com" >}}/https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/graviteeinsecure_secretSome of the values presented in this guide can automatically be replaced with documentation variables.
{{< sitevar-preferences >}}
The following YAML configuration is an example Authelia client configuration for use with Gravitee which will operate with the application example:
identity_providers:
oidc:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc
clients:
- client_id: 'gravitee'
client_name: 'Gravitee'
client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false
authorization_policy: 'two_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://gravitee.{{< sitevar name="domain" nojs="example.com" >}}/'
scopes:
- 'openid'
- 'email'
- 'profile'
- 'groups'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
To configure Gravitee there is one method, using the Web GUI.
{{< callout context="tip" title="Did you know?" icon="outline/rocket" >}}
Generally the configuration file is named gravitee.yaml.
{{< /callout >}}
To configure Gravitee to utilize Authelia as an OpenID Connect 1.0 Provider, use the following configuration:
security:
providers:
- type: 'oidc'
clientId: 'gravitee'
clientSecret: 'insecure_secret'
tokenIntrospectionEndpoint: 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/introspection'
tokenEndpoint: 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/token'
authorizeEndpoint: 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/authorization'
userInfoEndpoint: 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/userinfo'
syncMappings: true
scopes:
- 'openid'
- 'email'
- 'profile'
- 'groups'
userMapping:
id: 'sub'
email: 'email'
lastname: 'family_name'
firstname: 'given_name'
picture: 'photo'
roleMapping:
- condition: "{(#jsonPath(#profile, '$.groups') matches 'gravitee-admin' )}"
roles:
- "ORGANIZATION:ADMIN"
- "ENVIRONMENT:ADMIN"
To configure Gravitee to utilize Authelia as an OpenID Connect 1.0 Provider, use the following instructions:
+ New Auth Provider.Autheliagraviteeinsecure_secrethttps://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/authorizationhttps://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/tokenhttps://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/userinfohttps://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/jwks.jsonSubmit at the bottom.