feat(papra, romm): add feature

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -55,7 +55,7 @@ access_control:
     # authelia portal
     - domain: '{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}'
       policy: 'bypass'
-#    - domain: 'test.ilnmors.com'
+#    - domain: 'test.example.com'
 #      policy: 'one_factor'
 #      subject:
 #        - 'group:admins'
@@ -118,6 +118,23 @@ identity_providers:
       access_token: '1h'
       id_token: '1h'
       refresh_token: '720h'
+    cors:
+      # booklogr cors configuration
+      endpoints:
+        - 'authorization'
+        - 'token'
+        - 'userinfo'
+      allowed_origins:
+        - 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}'
+    claims_policies:
+      romm:
+        id_token:
+          - 'email'
+          - 'email_verified'
+          - 'alt_emails'
+          - 'preferred_username'
+          - 'name'
+          - 'groups'
     clients:
       # https://www.authelia.com/integration/openid-connect/clients/gitea/
       - client_id: 'gitea'
@@ -165,29 +182,6 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
-      # https://www.authelia.com/integration/openid-connect/clients/paperless/
-      - client_id: 'paperless'
-        client_name: 'Paperless'
-        consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['paperless']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: true
-        pkce_challenge_method: 'S256'
-        redirect_uris:
-          - 'https://{{ services['paperless']['domain']['public'] }}.{{ domain['public'] }}/accounts/oidc/authelia/login/callback/'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-          - 'groups'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'
       # https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
       - client_id: 'nextcloud'
         client_name: 'Nextcloud'
@@ -345,3 +339,71 @@ identity_providers:
         grant_types:
           - 'authorization_code'
         token_endpoint_auth_method: 'client_secret_basic'
+      # https://booklogr.app/docs/Configuration/OIDC-sign-in
+      - client_id: 'booklogr'
+        client_name: 'booklogr'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['booklogr']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_post'
+      # https://www.authelia.com/integration/openid-connect/clients/papra/
+      - client_id: 'papra'
+        client_name: 'papra'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['papra']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://{{ services['papra']['domain']['public'] }}.{{ domain['public'] }}/api/auth/oauth2/callback/authelia'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_post'
+      # https://www.authelia.com/integration/openid-connect/clients/romm/
+      - client_id: 'romm'
+        claims_policy: 'romm'
+        client_name: 'romm'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['romm']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://{{ services['romm']['domain']['public'] }}.{{ domain['public'] }}/api/oauth/openid'
+        scopes:
+          - 'openid'
+          - 'groups'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'