feat: init

Documentation/docs/onprem/configuration/authentication-modes/README.md

@@ -0,0 +1,10 @@
+---
+description: Twake let you authenticate using CAS or OpenID.
+---
+
+# 👨‍💻 Authentication modes
+
+Twake works with OpenID, CAS and in standalone.
+
+See child pages to configure with [KeyCloak](using-keycloak-ldap-openid-and-more.md) or [LemonLDAP](installing-twake-with-lemonldap-ldap-openid-and-more.md).
+

Documentation/docs/onprem/configuration/authentication-modes/installing-twake-with-lemonldap-ldap-openid-and-more.md

@@ -0,0 +1,52 @@
+---
+description: 'Harder than KeyCloak but has other features, see official LemonLDAP site.'
+---
+
+# Installing Twake with LemonLDAP \(LDAP, OpenID and more\)
+
+#### 1. Twake configuration
+
+Edit Twake PHP config `twake/backend/core/app/Configuration/Parameters.php`, in defaults.auth.openid
+
+```text
+"openid" => [
+    "use" => true,
+    "provider_uri" => 'http://auth.open-paas.org.local',
+    "client_id" => 'twake',
+    "client_secret" => 'secret',
+    "ignore_mail_verified" => true,
+    "ignore_id_token_verification" => true,
+    "provider_config" => [
+      "token_endpoint"=> "http://auth.open-paas.org.local/oauth2/token", //token_endpoint
+      "userinfo_endpoint" => "http://auth.open-paas.org.local/oauth2/userinfo",//userinfo_endpoint
+      "end_session_endpoint" => "http://auth.open-paas.org.local/oauth2/logout",//end_session_endpoint
+      "authorization_endpoint" => "http://auth.open-paas.org.local/oauth2/authorize",//authorization_endpoint
+    ]
+
+],
+```
+
+Add line to /etc/hosts if needed :
+
+`sudo docker-compose exec php bash -c "echo '51.210.124.92 manager.open-paas.org.local auth.open-paas.org.local reload.open-paas.org.local' >> /etc/hosts"`
+
+#### 2. Lemon LDAP configuration
+
+Dans ClientOpenIDConnect > twake > Options > Basique > Adresse connexion : [http://15.236.209.74/ajax/users/openid](http://15.236.209.74/ajax/users/openid)
+
+Dans ClientOpenIDConnect > twake > Attributs exportés :
+
+```text
+{
+  email_verified: email_verified,
+  picture: picture,
+  name: cn,
+  given_name: givenName,
+  family_name: sn,
+  email: mail,
+  sub: uid
+}
+```
+
+\[Ne marche pas pour le moment\] Dans ClientOpenIDConnect > twake > Options > Déconnexion > Adresse : [http://15.236.209.74/ajax/users/openid/logout\_success](http://15.236.209.74/ajax/users/openid/logout_success)
+

Documentation/docs/onprem/configuration/authentication-modes/using-keycloak-ldap-openid-and-more.md

@@ -0,0 +1,47 @@
+---
+description: Use Keycloak with Twake
+---
+
+# Using Keycloak \(LDAP, OpenID and more\)
+
+#### Run keycloak and persist data
+
+```text
+cd twake
+docker run -p 8080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -v $(pwd)/docker-data/keycloak-db:/opt/jboss/keycloak/standalone/data jboss/keycloak
+```
+
+#### Configure keycloak with twake for the first time
+
+**On Keycloak**
+
+Go to `http://localhost:8080/auth/`
+
+Login with admin:admin
+
+Go to client > account > Credentials tab and save the `Secret`
+
+Go to Settings tab and add a Valid Redirect uri to `http://localhost:8000/*` and save
+
+Then create an user in User / Add User
+
+⚠️ Users must have an email and the email must be marked as verified !
+
+Then create a password for this user.
+
+**On Twake**
+
+Go to your \[docker-compose file location\]/configuration/backend/Parameters.php \(see [Configuration](../)\)
+
+Change defaults.auth.openid to:
+
+```text
+  "use" => true,
+  "provider_uri" => 'http://[machine_ip]:8080/auth/realms/master',
+  "client_id" => 'account',
+  "client_secret" => '[keycloak_secret]',
+  "logout_suffix" => "/protocol/openid-connect/logout" //Specific to keycloak
+```
+
+ℹ️ \[machine\_ip\] Because Twake is accessing keycloak for inside a docker container, do not use localhost or 127.0.0.1 to access keycloak.
+