110 lines
4.6 KiB
Python
110 lines
4.6 KiB
Python
from django.db import transaction
|
|
from authentik.core.models import Application, Group, User
|
|
from authentik.policies.models import PolicyBinding
|
|
from authentik.providers.oauth2.models import OAuth2Provider
|
|
from authentik.providers.proxy.models import ProxyProvider
|
|
from authentik.outposts.models import Outpost
|
|
|
|
with transaction.atomic():
|
|
template = OAuth2Provider.objects.get(name="Argo CD")
|
|
redirect = template.redirect_uris[0]
|
|
provider, _ = OAuth2Provider.objects.get_or_create(
|
|
name="Paperless-ngx",
|
|
defaults={
|
|
"authorization_flow": template.authorization_flow,
|
|
"invalidation_flow": template.invalidation_flow,
|
|
"client_type": "confidential",
|
|
"grant_types": ["authorization_code", "refresh_token"],
|
|
"client_id": "paperless-ngx",
|
|
"client_secret": CLIENT_SECRET,
|
|
"signing_key": template.signing_key,
|
|
},
|
|
)
|
|
provider.authorization_flow = template.authorization_flow
|
|
provider.invalidation_flow = template.invalidation_flow
|
|
provider.client_type = "confidential"
|
|
provider.grant_types = ["authorization_code", "refresh_token"]
|
|
provider.client_id = "paperless-ngx"
|
|
provider.client_secret = CLIENT_SECRET
|
|
provider.signing_key = template.signing_key
|
|
provider.redirect_uris = [
|
|
type(redirect)(
|
|
matching_mode=redirect.matching_mode,
|
|
url="https://paper.brunner.ninja/accounts/oidc/authentik/login/callback/",
|
|
redirect_uri_type=redirect.redirect_uri_type,
|
|
)
|
|
]
|
|
provider.save()
|
|
provider.property_mappings.set(
|
|
template.property_mappings.filter(managed__startswith="goauthentik.io/providers/oauth2/scope-")
|
|
)
|
|
|
|
app, _ = Application.objects.get_or_create(
|
|
slug="paperless-ngx", defaults={"name": "Paperless-ngx", "provider": provider}
|
|
)
|
|
app.name = "Paperless-ngx"
|
|
app.provider = provider
|
|
app.meta_launch_url = "https://paper.brunner.ninja"
|
|
app.save()
|
|
|
|
group, _ = Group.objects.get_or_create(name="Paperless Users")
|
|
admin_group, _ = Group.objects.get_or_create(name="Paperless Admins")
|
|
owner = User.objects.get(username="feedc0de")
|
|
group.users.add(owner)
|
|
admin_group.users.add(owner)
|
|
binding, _ = PolicyBinding.objects.get_or_create(
|
|
target=app, group=group, defaults={"order": 0, "enabled": True}
|
|
)
|
|
if not binding.enabled:
|
|
binding.enabled = True
|
|
binding.save(update_fields=["enabled"])
|
|
|
|
proxy_template = ProxyProvider.objects.get(name="Provider for 30-birthday-admin")
|
|
scanner_url = "https://scanner.brunner.ninja"
|
|
scanner_provider, _ = ProxyProvider.objects.get_or_create(
|
|
name="Paperless scanner",
|
|
defaults={
|
|
"authorization_flow": proxy_template.authorization_flow,
|
|
"invalidation_flow": proxy_template.invalidation_flow,
|
|
"mode": "forward_single",
|
|
"external_host": scanner_url + "/",
|
|
},
|
|
)
|
|
scanner_provider.authorization_flow = proxy_template.authorization_flow
|
|
scanner_provider.invalidation_flow = proxy_template.invalidation_flow
|
|
scanner_provider.mode = "forward_single"
|
|
scanner_provider.external_host = scanner_url + "/"
|
|
scanner_provider.client_type = proxy_template.client_type
|
|
scanner_provider.grant_types = proxy_template.grant_types
|
|
callback_template = proxy_template.redirect_uris[0]
|
|
scanner_provider.redirect_uris = [
|
|
type(callback_template)(
|
|
matching_mode=callback_template.matching_mode,
|
|
url=scanner_url + suffix,
|
|
redirect_uri_type=callback_template.redirect_uri_type,
|
|
)
|
|
for suffix in (
|
|
"/outpost.goauthentik.io/callback?X-authentik-auth-callback=true",
|
|
"/?X-authentik-auth-callback=true",
|
|
)
|
|
]
|
|
scanner_provider.save()
|
|
scanner_provider.property_mappings.set(proxy_template.property_mappings.all())
|
|
scanner_app, _ = Application.objects.get_or_create(
|
|
slug="paperless-scanner",
|
|
defaults={"name": "Paperless scanner", "provider": scanner_provider},
|
|
)
|
|
scanner_app.name = "Paperless scanner"
|
|
scanner_app.provider = scanner_provider
|
|
scanner_app.meta_launch_url = scanner_url + "/"
|
|
scanner_app.save()
|
|
scanner_binding, _ = PolicyBinding.objects.get_or_create(
|
|
target=scanner_app, group=group, defaults={"order": 0, "enabled": True}
|
|
)
|
|
if not scanner_binding.enabled:
|
|
scanner_binding.enabled = True
|
|
scanner_binding.save(update_fields=["enabled"])
|
|
Outpost.objects.get(name="authentik Embedded Outpost").providers.add(scanner_provider)
|
|
|
|
print("PAPERLESS_AUTHENTIK_AND_SCANNER_READY")
|