local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 66 Pull requests 6 Projects 3 Releases Packages 1 Activity Actions

Add OIDC role sync config (OIDC_ADMIN_GROUP_NAME, OIDC_GROUPS_CLAIM)

Browse source 
Mv.OidcRoleSyncConfig reads from config; runtime.exs overrides from ENV in prod.
This commit is contained in:
Moritz 2026-02-04 16:15:47 +01:00 • committed by moritz
parent 50c8a0dc9a
commit a6e35da0f7
4 changed files with 83 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
config/config.exs
View file

@ -58,6 +58,11 @@ config :mv,
max_rows: 1000
]
# OIDC group → role sync (optional). Overridden in runtime.exs from ENV in production.
config :mv, :oidc_role_sync,
admin_group_name: nil,
groups_claim: "groups"
# Configures the endpoint
config :mv, MvWeb.Endpoint,
url: [host: "localhost"],

5
config/runtime.exs
View file

@ -153,6 +153,11 @@ if config_env() == :prod do
client_secret: client_secret,
redirect_uri: System.get_env("OIDC_REDIRECT_URI") || default_redirect_uri
# OIDC group → Admin role sync (optional). Groups claim default "groups".
config :mv, :oidc_role_sync,
admin_group_name: System.get_env("OIDC_ADMIN_GROUP_NAME"),
groups_claim: System.get_env("OIDC_GROUPS_CLAIM") || "groups"
# Token signing secret from environment variable
# This overrides the placeholder value set in prod.exs
# Supports TOKEN_SIGNING_SECRET or TOKEN_SIGNING_SECRET_FILE for Docker secrets.