Only the OAuth2 auth strategy was using the state parameter, which should be used as described in the RFC. The other auth strategies such as GitHub, GitLab or Google were lacking the state parameter. This change adds the required state parameter as well as enabling PKCE support on providers where it's possible. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
145 lines
5.3 KiB
JSON
145 lines
5.3 KiB
JSON
{
|
|
"test": {
|
|
"db": {
|
|
"dialect": "sqlite",
|
|
"storage": ":memory:"
|
|
},
|
|
"linkifyHeaderStyle": "gfm"
|
|
},
|
|
"development": {
|
|
"loglevel": "debug",
|
|
"db": {
|
|
"dialect": "sqlite",
|
|
"storage": "./db.hedgedoc.sqlite"
|
|
},
|
|
"domain": "localhost",
|
|
"urlAddPort": true
|
|
},
|
|
"production": {
|
|
"domain": "change this",
|
|
"loglevel": "info",
|
|
"hsts": {
|
|
"enable": true,
|
|
"maxAgeSeconds": 31536000,
|
|
"includeSubdomains": true,
|
|
"preload": true
|
|
},
|
|
"csp": {
|
|
"enable": true,
|
|
"directives": {
|
|
},
|
|
"upgradeInsecureRequests": "auto",
|
|
"addDefaults": true,
|
|
"addDisqus": true,
|
|
"addGoogleAnalytics": true
|
|
},
|
|
"cookiePolicy": "lax",
|
|
"db": {
|
|
"username": "",
|
|
"password": "",
|
|
"database": "hedgedoc",
|
|
"host": "localhost",
|
|
"port": "5432",
|
|
"dialect": "postgres"
|
|
},
|
|
"facebook": {
|
|
"clientID": "change this",
|
|
"clientSecret": "change this"
|
|
},
|
|
"twitter": {
|
|
"consumerKey": "change this",
|
|
"consumerSecret": "change this"
|
|
},
|
|
"github": {
|
|
"clientID": "change this",
|
|
"clientSecret": "change this"
|
|
},
|
|
"gitlab": {
|
|
"baseURL": "change this",
|
|
"clientID": "change this",
|
|
"clientSecret": "change this",
|
|
"scope": "use 'read_user' scope for auth user only or remove this property if you need gitlab snippet import/export support (will result to be default scope 'api')",
|
|
"version": "use 'v4' if gitlab version > 11, 'v3' otherwise. Default to 'v4'"
|
|
},
|
|
"mattermost": {
|
|
"baseURL": "change this",
|
|
"clientID": "change this",
|
|
"clientSecret": "change this"
|
|
},
|
|
"dropbox": {
|
|
"clientID": "change this",
|
|
"clientSecret": "change this",
|
|
"appKey": "change this"
|
|
},
|
|
"google": {
|
|
"clientID": "change this",
|
|
"clientSecret": "change this",
|
|
"apiKey": "change this"
|
|
},
|
|
"ldap": {
|
|
"url": "ldap://change_this",
|
|
"bindDn": null,
|
|
"bindCredentials": null,
|
|
"searchBase": "change this",
|
|
"searchFilter": "change this",
|
|
"searchAttributes": ["change this"],
|
|
"usernameField": "change this e.g. cn",
|
|
"useridField": "change this e.g. uid",
|
|
"tlsOptions": {
|
|
"changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback"
|
|
}
|
|
},
|
|
"saml": {
|
|
"idpSsoUrl": "change: authentication endpoint of IdP",
|
|
"idpCert": "change: certificate file path of IdP in PEM format",
|
|
"issuer": "change or delete: identity of the service provider (default: config.serverURL)",
|
|
"identifierFormat": "change or delete: name identifier format (default: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress')",
|
|
"disableRequestedAuthnContext": "change or delete: true to allow any authentication method, false restricts to password authentication method (default: false)",
|
|
"wantAssertionsSigned": "change or delete: true to enforce signed assertions, false allows unsigned assertions (default: true)",
|
|
"wantAuthnResponseSigned": "change or delete: true to enforce signed response, false allows unsigned response (default: true)",
|
|
"groupAttribute": "change or delete: attribute name for group list (ex: memberOf)",
|
|
"requiredGroups": [ "change or delete: group names that allowed" ],
|
|
"externalGroups": [ "change or delete: group names that not allowed" ],
|
|
"attribute": {
|
|
"id": "change or delete this: attribute map for `id` (default: NameID)",
|
|
"username": "change or delete this: attribute map for `username` (default: NameID)",
|
|
"email": "change or delete this: attribute map for `email` (default: NameID)"
|
|
}
|
|
},
|
|
"oauth2": {
|
|
"baseURL": "https://auth.example.com/",
|
|
"userProfileURL": "https://auth.example.com/oauth2/userinfo/",
|
|
"tokenURL": "https://auth.example.com/oauth2/token/",
|
|
"authorizationURL": "https://auth.example.com/oauth2/authorize/",
|
|
"clientID": "change-this-id",
|
|
"clientSecret": "change-this-secret",
|
|
"scope": "openid profile user",
|
|
"userProfileUsernameAttr": "preferred_username",
|
|
"userProfileEmailAttr": "email",
|
|
"userProfileDisplayNameAttr": "name",
|
|
"pkce": true
|
|
},
|
|
"imgur": {
|
|
"clientID": "change this"
|
|
},
|
|
"minio": {
|
|
"accessKey": "change this",
|
|
"secretKey": "change this",
|
|
"endPoint": "change this",
|
|
"secure": true,
|
|
"port": 9000
|
|
},
|
|
"s3": {
|
|
"accessKeyId": "change this",
|
|
"secretAccessKey": "change this",
|
|
"region": "change this"
|
|
},
|
|
"s3bucket": "change this",
|
|
"azure":
|
|
{
|
|
"connectionString": "change this",
|
|
"container": "change this"
|
|
}
|
|
}
|
|
}
|