onap-oauth2-proxy:
  # Oauth client configuration specifics
  config:
    cookieSecret: "CbgXFXDJ16laaCfChtFBpKy1trNEmJZDIjaiaIMLyRA="
    configFile: |-
      email_domains = [ "*" ]        # Restrict to these E-Mail Domains, a wildcard "*" allows any email

  alphaConfig:
    enabled: true
    configData:
      providers:
      - clientID: "oauth2-proxy"
        clientSecret: "5YSOkJz99WHv8enDZPknzJuGqVSerELp"
        id: oidc-istio
        provider: oidc   # We use the generic 'oidc' provider
        loginURL: https://keycloak-ui.simpledemo.onap.org/auth/realms/ONAP/protocol/openid-connect/auth
        #redeemURL: https://keycloak-ui.simpledemo.onap.org/auth/realms/ONAP/protocol/openid-connect/token
        redeemURL: http://keycloak-http.keycloak/auth/realms/ONAP/protocol/openid-connect/token
        profileURL: https://keycloak-ui.simpledemo.onap.org/auth/realms/ONAP/protocol/openid-connect/userinfo
        validateURL: https://keycloak-ui.simpledemo.onap.org/auth/realms/ONAP/protocol/openid-connect/userinfo
        scope: "openid email profile groups"
        #allowedGroups:
        # - admins # List all groups managed at our your IdP which should be allowed access
        # - infrateam
        # - anothergroup
        oidcConfig:
          emailClaim: email  # Name of the clain in JWT containing the E-Mail
          groupsClaim: groups # Name of the claim in JWT containing the Groups
          userIDClaim: email  # Name of the claim in JWT containing the User ID
          audienceClaims: ["aud"]
          insecureAllowUnverifiedEmail: true
          insecureSkipIssuerVerification: true
          skipDiscovery: true # You can try using the well-knwon endpoint directly for auto discovery, here we won't use it
          issuerURL: https://keycloak-ui.simpledemo.onap.org/auth/realms/ONAP
          jwksURL: http://keycloak-http.keycloak/auth/realms/ONAP/protocol/openid-connect/certs
      upstreamConfig:
        upstreams:
          - id: static_200
            path: /
            static: true
            staticCode: 200
      # Headers that should be added to responses from the proxy
      injectResponseHeaders: # Send this headers in responses from oauth2-proxy
        - name: X-Auth-Request-Preferred-Username
          values:
            - claim: preferred_username
        - name: X-Auth-Request-Email
          values:
            - claim: email

  extraArgs:
    cookie-secure: "false"
    cookie-domain: ".simpledemo.onap.org"    # Replace with your base domain
    cookie-samesite: lax
    cookie-expire: 12h               # How long our Cookie is valid
    auth-logging: true               # Enable / Disable auth logs
    request-logging: true            # Enable / Disable request logs
    standard-logging: true           # Enable / Disable the standart logs
    show-debug-on-error: true        # Disable in production setups
    skip-provider-button: true       # We only have one provider configured (Keycloak)
    silence-ping-logging: true       # Keeps our logs clean
    whitelist-domain: ".simpledemo.onap.org" # Replace with your base domain

  # Enables and configure the automatic deployment of the redis subchart
  redis:
    # provision an instance of the redis sub-chart
    enabled: false


serviceAccount:
  nameOverride: oauth2-proxy
  roles:
    - read