56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
version: 1
|
|
metadata:
|
|
labels:
|
|
blueprints.goauthentik.io/system: "true"
|
|
name: System - Kerberos Source - Mappings
|
|
entries:
|
|
- identifiers:
|
|
managed: goauthentik.io/sources/kerberos/user/default/multipart-principals-as-service-accounts
|
|
model: authentik_sources_kerberos.kerberossourcepropertymapping
|
|
attrs:
|
|
name: "authentik default Kerberos User Mapping: Multipart principals as service accounts"
|
|
expression: |
|
|
from authentik.core.models import USER_PATH_SERVICE_ACCOUNT, UserTypes
|
|
|
|
localpart, _ = principal.rsplit("@", 1)
|
|
is_service_account = "/" in localpart
|
|
attrs = {}
|
|
if is_service_account:
|
|
attrs = {
|
|
"type": UserTypes.SERVICE_ACCOUNT,
|
|
"path": USER_PATH_SERVICE_ACCOUNT,
|
|
}
|
|
return attrs
|
|
- identifiers:
|
|
managed: goauthentik.io/sources/kerberos/user/default/ignore-other-realms
|
|
model: authentik_sources_kerberos.kerberossourcepropertymapping
|
|
attrs:
|
|
name: "authentik default Kerberos User Mapping: Ignore other realms"
|
|
expression: |
|
|
localpart, realm = principal.rsplit("@", 1)
|
|
if realm.upper() != source.realm.upper():
|
|
raise SkipObject
|
|
return {}
|
|
- identifiers:
|
|
managed: goauthentik.io/sources/kerberos/user/default/ignore-system-principals
|
|
model: authentik_sources_kerberos.kerberossourcepropertymapping
|
|
attrs:
|
|
name: "authentik default Kerberos User Mapping: Ignore system principals"
|
|
expression: |
|
|
localpart, realm = principal.rsplit("@", 1)
|
|
denied_prefixes = ["kadmin/", "krbtgt/", "K/M", "WELLKNOWN/", "kiprop/", "changepw/"]
|
|
for prefix in denied_prefixes:
|
|
if localpart.lower().startswith(prefix.lower()):
|
|
raise SkipObject
|
|
return {}
|
|
- identifiers:
|
|
managed: goauthentik.io/sources/kerberos/user/realm-as-group
|
|
model: authentik_sources_kerberos.kerberossourcepropertymapping
|
|
attrs:
|
|
name: "authentik default Kerberos User Mapping: Add realm as group"
|
|
expression: |
|
|
localpart, realm = principal.rsplit("@", 1)
|
|
return {
|
|
"groups": [realm.upper()]
|
|
}
|