--- login: title: "luzifer.io - Login" default_method: "simple" default_redirect: "https://luzifer.io/" hide_mfa_field: false names: simple: "Username / Password" yubikey: "Yubikey" cookie: domain: ".example.com" authentication_key: "Ff1uWJcLouKu9kwxgbnKcU3ps47gps72sxEz79TGHFCpJNCPtiZAFDisM4MWbstH" expire: 3600 # Optional, default: 3600 prefix: "nginx-sso" # Optional, default: nginx-sso secure: true # Optional, default: false # Optional, default: 127.0.0.1:8082 listen: addr: "127.0.0.1" port: 8082 audit_log: targets: - fd://stdout - file:///var/log/nginx-sso/audit.jsonl events: ['access_denied', 'login_success', 'login_failure', 'logout', 'validate'] headers: ['x-origin-uri'] trusted_ip_headers: ["X-Forwarded-For", "RemoteAddr", "X-Real-IP"] acl: rule_sets: - rules: - field: "host" equals: "test.example.com" - field: "x-origin-uri" regexp: "^/api" allow: ["luzifer", "@admins"] mfa: yubikey: # Get your client / secret from https://upgrade.yubico.com/getapikey/ client_id: "12345" secret_key: "foobar" duo: # Get your ikey / skey / host from https://duo.com/docs/duoweb#first-steps ikey: "IKEY" skey: "SKEY" host: "HOST" user_agent: "nginx-sso" plugins: directory: ./plugins/ providers: # Authentication against an Atlassian Crowd directory server # Supports: Users, Groups crowd: url: "https://crowd.example.com/crowd/" app_name: "" app_pass: "" # Authentication through OAuth2 workflow with Google Account # Supports: Users google_oauth: client_id: "" client_secret: "" redirect_url: "https://login.luifer.io/login" # Optional, defaults to no limitations require_domain: "example.com" # Optional, defaults to "user-id" user_id_method: "full-email" # Authentication against (Open)LDAP server # Supports: Users, Groups ldap: enable_basic_auth: false manager_dn: "cn=admin,dc=example,dc=com" manager_password: "" root_dn: "dc=example,dc=com" server: "ldap://ldap.example.com" # Optional, defaults to root_dn user_search_base: ou=users,dc=example,dc=com # Optional, defaults to '(uid={0})' user_search_filter: "" # Optional, defaults to root_dn group_search_base: "ou=groups,dc=example,dc=com" # Optional, defaults to '(|(member={0})(uniqueMember={0}))' group_membership_filter: "" # Replace DN as the username with another attribute # Optional, defaults to "dn" username_attribute: "uid" # Configure TLS parameters for LDAPs connections # Optional, defaults to null tls_config: # Set the hostname for certificate validation # Optional, defaults to host from the connection URI validate_hostname: ldap.example.com # Disable certificate validation # Optional, defaults to false allow_insecure: false # Authentication through OAuth2 workflow with OpenID Connect provider # Supports: Users oidc: client_id: "" client_secret: "" # Optional, defaults to "OpenID Connect" issuer_name: "" issuer_url: "" redirect_url: "https://login.luifer.io/login" # Optional, defaults to no limitations require_domain: "example.com" # Optional, defaults to "subject" user_id_method: "full-email" # Authentication against embedded user database # Supports: Users, Groups, MFA simple: enable_basic_auth: false # Unique username mapped to bcrypt hashed password users: luzifer: "$2a$10$FSGAF8qDWX52aBID8.WpxOyCvfSQ3JIUVFiwyd1jolb4jM3BzJmNu" # Groupname to users mapping groups: admins: ["luzifer"] # MFA configs: Username to configs mapping mfa: luzifer: - provider: duo - provider: totp attributes: secret: MZXW6YTBOIFA # required period: 30 # optional, defaults to 30 (Google Authenticator) skew: 1 # optional, defaults to 1 (Google Authenticator) digits: 8 # optional, defaults to 6 (Google Authenticator) algorithm: sha1 # optional (sha1, sha256, sha512), defaults to sha1 (Google Authenticator) - provider: yubikey attributes: device: ccccccfcvuul # Authentication against embedded token directory # Supports: Users, Groups token: # Mapping of unique token names to the token tokens: tokenname: "MYTOKEN" # Groupname to token mapping groups: mytokengroup: ["tokenname"] # Authentication against Yubikey cloud validation servers # Supports: Users, Groups yubikey: # Get your client / secret from https://upgrade.yubico.com/getapikey/ client_id: "12345" secret_key: "foobar" # First 12 characters of the OTP string mapped to the username devices: ccccccfcvuul: "luzifer" # Groupname to users mapping groups: admins: ["luzifer"] ...