1f3d0f9239
This endpoint does not strictly follow the OAuth2 Machine-to-Machine specification, as we introduce the concept of user delegation (instead of using the term impersonation). Typically, OAuth2 M2M is used only to authenticate a machine in server-to-server exchanges. In our case, we require external applications to act on behalf of a user in order to assign room ownership and access. Since these external applications are not integrated with our authorization server, a workaround was necessary. We treat the delegated user’s email as a form of scope and issue a JWT to the application if it is authorized to request it. Using the term scope for an email may be confusing, but it remains consistent with OAuth2 vocabulary and allows for future extension, such as supporting a proper M2M process without any user delegation. It is important not to confuse the scope in the request body with the scope in the generated JWT. The request scope refers to the delegated email, while the JWT scope defines what actions the external application can perform on our viewset, matching Django’s viewset method naming. The viewset currently contains a significant amount of logic. I did not find a clean way to split it without reducing maintainability, but this can be reconsidered in the future. Error messages are intentionally vague to avoid exposing sensitive information to attackers.
72 lines
2.1 KiB
Plaintext
72 lines
2.1 KiB
Plaintext
# Django
|
|
DJANGO_ALLOWED_HOSTS=*
|
|
DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
|
|
DJANGO_SETTINGS_MODULE=meet.settings
|
|
DJANGO_SUPERUSER_PASSWORD=admin
|
|
|
|
# Python
|
|
PYTHONPATH=/app
|
|
|
|
# Meet settings
|
|
|
|
# Mail
|
|
DJANGO_EMAIL_HOST="mailcatcher"
|
|
DJANGO_EMAIL_PORT=1025
|
|
DJANGO_EMAIL_BRAND_NAME=La Suite Numérique
|
|
DJANGO_EMAIL_SUPPORT_EMAIL=test@yopmail.com
|
|
DJANGO_EMAIL_LOGO_IMG=http://localhost:3000/assets/logo-suite-numerique.png
|
|
DJANGO_EMAIL_DOMAIN=localhost:3000
|
|
DJANGO_EMAIL_APP_BASE_URL=http://localhost:3000
|
|
|
|
# Backend url
|
|
MEET_BASE_URL="http://localhost:8072"
|
|
|
|
# Media
|
|
STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
|
|
AWS_S3_ENDPOINT_URL=http://minio:9000
|
|
AWS_S3_ACCESS_KEY_ID=meet
|
|
AWS_S3_SECRET_ACCESS_KEY=password
|
|
|
|
# OIDC
|
|
OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/meet/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/meet/protocol/openid-connect/userinfo
|
|
|
|
OIDC_RP_CLIENT_ID=meet
|
|
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
|
|
LOGIN_REDIRECT_URL=http://localhost:3000
|
|
LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
|
|
LOGOUT_REDIRECT_URL=http://localhost:3000
|
|
|
|
OIDC_REDIRECT_ALLOWED_HOSTS=localhost:8083,localhost:3000
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
|
|
|
|
# Livekit Token settings
|
|
LIVEKIT_API_SECRET=secret
|
|
LIVEKIT_API_KEY=devkey
|
|
LIVEKIT_API_URL=http://127.0.0.1.nip.io:7880
|
|
LIVEKIT_VERIFY_SSL=False
|
|
ALLOW_UNREGISTERED_ROOMS=False
|
|
|
|
# Recording
|
|
RECORDING_ENABLE=True
|
|
RECORDING_STORAGE_EVENT_ENABLE=True
|
|
RECORDING_STORAGE_EVENT_TOKEN=password
|
|
SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v1/tasks/
|
|
SUMMARY_SERVICE_API_TOKEN=password
|
|
SCREEN_RECORDING_BASE_URL=http://localhost:3000/recordings
|
|
|
|
# Telephony
|
|
ROOM_TELEPHONY_ENABLED=True
|
|
|
|
FRONTEND_USE_FRENCH_GOV_FOOTER=False
|
|
FRONTEND_USE_PROCONNECT_BUTTON=False
|
|
|
|
# External Applications
|
|
APPLICATION_JWT_AUDIENCE=http://localhost:8071/external-api/v1.0/
|
|
APPLICATION_JWT_SECRET_KEY=devKey
|