70 lines
2.9 KiB
Terraform
70 lines
2.9 KiB
Terraform
# =============================================================================
|
|
# CLOUDFLARE : Integrations : Identity Providers
|
|
# =============================================================================
|
|
|
|
#
|
|
resource "cloudflare_zero_trust_access_identity_provider" "gmail" {
|
|
account_id = local.cloudflare_account_id
|
|
name = "Gmail"
|
|
type = "google"
|
|
zone_id = local.cloudflare_zone_id
|
|
|
|
config = {
|
|
client_id = "<google_client_id>"
|
|
client_secret = "<google_secret>"
|
|
email_claim_name = "email"
|
|
}
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE IdP n°1 : Authentik (OIDC générique)
|
|
# Secrets lus depuis Vault : secret/authentik
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_access_identity_provider" "authentik_oidc" {
|
|
account_id = local.cloudflare_account_id
|
|
name = "Authentik OIDC"
|
|
type = "oidc"
|
|
zone_id = local.cloudflare_zone_id
|
|
|
|
config = {
|
|
auth_url = "https://authentik.${var.cloudflare_authentik_domain}/application/o/authorize/"
|
|
certs_url = "https://authentik.${var.cloudflare_authentik_domain}/application/o/cloudflare-access/jwks/"
|
|
claims = ["given_name", "preferred_username", "nickname", "groups", "role"]
|
|
client_id = local.authentik_oidc_client_id_cloudflare
|
|
client_secret = local.authentik_oidc_secret_cloudflare
|
|
email_claim_name = "email"
|
|
scopes = ["openid", "email", "profile"]
|
|
token_url = "https://authentik.${var.cloudflare_authentik_domain}/application/o/token/"
|
|
}
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE IdP n°2 : Azure Entra ID (miroir de la brique Authentik)
|
|
# Secrets lus depuis Vault : secret/azure
|
|
# - client_id_cloudflare : Application (client) ID de l'App Registration
|
|
# - secret_cloudflare : Client secret de l'App Registration
|
|
# - directory_id : Directory (tenant) ID
|
|
#
|
|
# ACTIONS EXTERNES (voir ACTIONS_EXTERNES.md) :
|
|
# 1. Créer une App Registration dans Azure Entra ID avec l'URL de redirection
|
|
# https://<team_name>.cloudflareaccess.com/cdn-cgi/access/callback
|
|
# 2. Créer le secret "secret/azure" dans Vault avec les 3 clés ci-dessus
|
|
# 3. Passer azure_idp_enabled = true dans variables.auto.tfvars
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_access_identity_provider" "azure_entra_id" {
|
|
count = var.azure_idp_enabled ? 1 : 0
|
|
|
|
account_id = local.cloudflare_account_id
|
|
name = "Azure Entra ID"
|
|
type = "azureAD"
|
|
|
|
config = {
|
|
client_id = local.azure_oidc_client_id_cloudflare
|
|
client_secret = local.azure_oidc_secret_cloudflare
|
|
directory_id = local.azure_directory_id
|
|
# Remonter les groupes Entra ID dans les claims -> utilisables dans les
|
|
# rule groups (Access_Controls-Policies-Rule_Groups-Azure.tf)
|
|
support_groups = true
|
|
}
|
|
}
|