habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

website: format docs with prettier (#2833)

Browse Source 
* run prettier

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add scim to comparison

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens L
2022-05-09 21:22:41 +02:00
committed by GitHub
parent 26d92d9259
commit f9469e3f99
148 changed files with 3447 additions and 3107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
website/docs/core/certificates.md
View File

@ -4,15 +4,15 @@ title: Certificates
Certificates in authentik are used for the following use cases:
- Signing and verifying SAML Requests and Responses
- Signing JSON Web Tokens for OAuth and OIDC
- Connecting to remote docker hosts using the Docker integration
- Verifying LDAP Servers' certificates
- Encrypting outposts's endpoints
- Signing and verifying SAML Requests and Responses
- Signing JSON Web Tokens for OAuth and OIDC
- Connecting to remote docker hosts using the Docker integration
- Verifying LDAP Servers' certificates
- Encrypting outposts's endpoints
## Default certificate
Every authentik install generates a self-signed certificate on the first start. The certificate is called *authentik Self-signed Certificate* and is valid for 1 year.
Every authentik install generates a self-signed certificate on the first start. The certificate is called _authentik Self-signed Certificate_ and is valid for 1 year.
This certificate is generated to be used as a default for all OAuth2/OIDC providers, as these don't require the certificate to be configured on both sides (the signature of a JWT is validated using the [JWKS](https://auth0.com/docs/security/tokens/json-web-tokens/json-web-key-sets) URL).
@ -30,7 +30,7 @@ For Kubernetes, you can map custom secrets/volumes under `/certs`.
You can also bind mount single files into the folder, as long as they fall under this naming schema.
- Files in the root directory will be imported based on their filename.
- Files in the root directory will be imported based on their filename.
`/foo.pem` Will be imported as the keypair `foo`. Based on its content its either imported as certificate or private key.
@ -38,9 +38,9 @@ You can also bind mount single files into the folder, as long as they fall under
Otherwise it will be imported as certificate.
- If the file is called `fullchain.pem` or `privkey.pem` (the output naming of certbot), they will get the name of the parent folder.
- Files can be in any arbitrary file structure, and can have any extension.
- If the path contains `archive`, the files will be ignored (to better support certbot setups).
- If the file is called `fullchain.pem` or `privkey.pem` (the output naming of certbot), they will get the name of the parent folder.
- Files can be in any arbitrary file structure, and can have any extension.
- If the path contains `archive`, the files will be ignored (to better support certbot setups).
```
certs/
@ -66,29 +66,29 @@ Starting with authentik 2021.12.4, you can configure the certificate authentik u
To use let's encrypt certificates with this setup, using certbot, you can use this compose override (create or edit a file called `docker-compose.override.yml` in the same folder as the authentik docker-compose file)
```yaml
version: '3.2'
version: "3.2"
services:
certbot:
image: certbot/dns-route53:v1.22.0
volumes:
- ./letsencrypt:/etc/letsencrypt
- ../authentik/certs/:/etc/letsencrypt/live
# Variables depending on DNS Plugin
environment:
AWS_ACCESS_KEY_ID: ...
command:
- certonly
- --non-interactive
- --agree-tos
- -m your.email@company
- -d authentik.company
# Again, match with your provider
- --dns-route53
certbot:
image: certbot/dns-route53:v1.22.0
volumes:
- ./letsencrypt:/etc/letsencrypt
- ../authentik/certs/:/etc/letsencrypt/live
# Variables depending on DNS Plugin
environment:
AWS_ACCESS_KEY_ID: ...
command:
- certonly
- --non-interactive
- --agree-tos
- -m your.email@company
- -d authentik.company
# Again, match with your provider
- --dns-route53
```
Afterwards, run `docker-compose up -d`, which will start certbot and generate your certificate. Within a few minutes, you'll see the certificate in your authentik interface. (If the certificate does not appear, restart the worker container. This is caused by incompatible permissions set by certbot).
Navigate to *System -> Tenants*, edit any tenant and select the certificate of your choice.
Navigate to _System -> Tenants_, edit any tenant and select the certificate of your choice.
Keep in mind this certbot container will only run once, but there are a variety of ways to schedule regular renewals.