136 lines
4.7 KiB
C#
136 lines
4.7 KiB
C#
/*
|
||
* dbMango
|
||
*
|
||
* Copyright 2025 Deutsche Bank AG
|
||
* SPDX-License-Identifier: Apache-2.0
|
||
*
|
||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||
* you may not use this file except in compliance with the License.
|
||
* You may obtain a copy of the License at
|
||
*
|
||
* http://www.apache.org/licenses/LICENSE-2.0
|
||
*
|
||
* Unless required by applicable law or agreed to in writing, software
|
||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
* See the License for the specific language governing permissions and
|
||
* limitations under the License.
|
||
*/
|
||
using System.Diagnostics.CodeAnalysis;
|
||
// ReSharper disable AutoPropertyCanBeMadeGetOnly.Global
|
||
|
||
namespace Rms.Service.Bootstrap.Security;
|
||
|
||
/// <summary>
|
||
/// Settings for Oidc
|
||
/// </summary>
|
||
[SuppressMessage("ReSharper", "AutoPropertyCanBeMadeGetOnly.Global")]
|
||
public class OidcSettings
|
||
{
|
||
/// <summary>
|
||
/// Client ID (application ID)
|
||
/// </summary>
|
||
public string ClientId { get; set; } = "";
|
||
/// <summary>
|
||
/// Additional ClientIds to accept while validating JWTs.
|
||
/// Works only when user access token passed thru the request headers.
|
||
/// I.e. for use withing API servers.
|
||
/// </summary>
|
||
public string[] ValidClientIds { get; set; } = [];
|
||
/// <summary>
|
||
/// Application secret
|
||
/// </summary>
|
||
public string Secret { get; set; } = "";
|
||
/// <summary>
|
||
/// Well-known OAuth configuration URL
|
||
/// If <see cref="ConfigCacheFile"/> supplied the config will be cached there.
|
||
/// </summary>
|
||
public string ConfigUrl { get; set; } = "";
|
||
/// <summary>
|
||
/// If configuration can't be loaded from <see cref="ConfigUrl"/> it will be loaded from this
|
||
/// file instead (if exists).
|
||
/// </summary>
|
||
public string? ConfigCacheFile { get; set; }
|
||
/// <summary>
|
||
/// Force different protocol on redirection URL. Useful if you are running in Docker container
|
||
/// under service mesh where SSL termination happening on the Egress gateway.
|
||
/// </summary>
|
||
public string? ForceRedirectUrlProtocol { get; set; }
|
||
/// <summary>
|
||
/// Force different port on redirection URL. Useful if you are running in Docker container
|
||
/// under service mesh where SSL termination happening on the Egress gateway.
|
||
/// </summary>
|
||
public int ForceRedirectUrlPort { get; set; }
|
||
}
|
||
|
||
|
||
/// <summary>
|
||
/// Ldap settings
|
||
/// </summary>
|
||
public class LdapSettings
|
||
{
|
||
/// <summary>
|
||
/// AD server URL in form of ldaps://xxx.com
|
||
/// </summary>
|
||
public string Url { get; set; } = "";
|
||
|
||
public string Username { get; set; } = "";
|
||
public string Password { get; set; } = "";
|
||
public string EntryPoint { get; set; } = "";
|
||
public Dictionary<string, string> RoleGroupMapping { get; set; } = new();
|
||
}
|
||
|
||
/// <summary>
|
||
/// Security related settings
|
||
/// </summary>
|
||
[SuppressMessage("ReSharper", "CollectionNeverUpdated.Global")]
|
||
public class SecuritySettings
|
||
{
|
||
/// <summary>
|
||
/// X.509 server (my) certificate file name.
|
||
/// If empty no certificate will be used for server (http server in a service mesh).
|
||
/// </summary>
|
||
public string CertificateFileName { get; set; } = "";
|
||
/// <summary>
|
||
/// X.509 server (my) certificate password.
|
||
/// If empty no certificate will be used for server (http server in a service mesh).
|
||
/// </summary>
|
||
public string CertificatePassword { get; set; } = "";
|
||
|
||
/// <summary>
|
||
/// Predefined roles definition. This can be loaded from dbEntitlements
|
||
/// </summary>
|
||
public Dictionary<string, string[]> Roles { get; set; } = new();
|
||
|
||
/// <summary>
|
||
/// Secret to be used to issue JWT tokens.
|
||
/// This property must be either encrypted or generated at the startup.
|
||
/// </summary>
|
||
public string Secret { get; set; } = "";
|
||
|
||
/// <summary>
|
||
/// Inactive user will be logged off after this time span
|
||
/// </summary>
|
||
public TimeSpan LogoffIdlePeriod { get; set; } = TimeSpan.FromMinutes(15);
|
||
|
||
/// <summary>
|
||
/// Configuration for Oidc. <see cref="OidcSettings"/>
|
||
/// </summary>
|
||
public OidcSettings Oidc { get; set; } = new ();
|
||
|
||
/// <summary>
|
||
/// If certificate-based authentication is in use issuer with this name
|
||
/// must be present in the certificate chain.
|
||
/// </summary>
|
||
public HashSet<string> CASubjectToAccept { get; set; } = [];
|
||
|
||
/// <summary>
|
||
/// Client certificate CN to be access granted.
|
||
/// </summary>
|
||
public HashSet<string> ClientCertWhiteList { get; set; } = [];
|
||
|
||
/// <summary>
|
||
/// LDAP settings
|
||
/// </summary>
|
||
public LdapSettings Ldap { get; set; } = new();
|
||
} |