# Any configuration directives you include  here will override
# RT's default configuration file, RT_Config.pm
#
# To include a directive here, just copy the equivalent statement
# from RT_Config.pm and change the value. We've included a single
# sample value below.
#
# If this file includes non-ASCII characters, it must be encoded in
# UTF-8.
#
# This file is actually a perl module, so you can include valid
# perl code, as well.
#
# The converse is also true, if this file isn't valid perl, you're
# going to run into trouble. To check your SiteConfig file, use
# this command:
#
#   perl -c /path/to/your/etc/RT_SiteConfig.pm
#

# You may also split settings into separate files under the etc/RT_SiteConfig.d/
# directory.  All files ending in ".pm" will be parsed, in alphabetical order,
# after this file is loaded.
1;
Set($DisableGraphViz, 1);
Set(%OAuthIDPs,
    'keycloak' => {
        # You must Set($AuthentikHost, "auth.example.com");
        # You must Set($AuthentikSlug, "rt");
        'MetadataHandler' => 'RT::Authen::OAuth2::Google',
        'MetadataMap' => {
          Name => 'preferred_username',
          EmailAddress => 'email',
          RealName => 'name',
          NickName => 'nickname',
          Lang => 'not-provided',
          Organization => 'not-provided',
          VerifiedEmail => 'email_verified',
        },
        # LoadColumn - see SECURITY CONSIDERATIONS above.
        'LoadColumn' => 'EmailAddress',
        'name' => 'Keycloak',
        'site' => 'http://{{ keycloak.host }}',
        'LoginPageButton' => '/static/images/btn_authentik_signin.png',
        'protected_resource_path' => '/realms/{{ keycloak.realm }}/protocol/openid-connect/userinfo',
        'authorize_path' => '/realms/{{ keycloak.realm }}/protocol/openid-connect/auth',
        'scope' => 'openid profile email',
        'access_token_path' => '/realms/{{ keycloak.realm }}/protocol/openid-connect/token/',
        'logout_path' => '/realms/{{ keycloak.realm }}/protocol/openid-connect/logout',
        'state' => '',
    },
);

Set(%OAuthIDPSecrets,
    'google' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'auth0' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'authentik' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'okta' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'instagram' => {
        'client_id' => '',
        'client_secret' => '',
     },
    '37signals' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'yandex' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'facebook' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'mixi' => {
        'client_id' => '',
        'client_secret' => '',
     },
    'keycloak' => {
        client_id => '{{ keycloak.client_id }}',
        client_secret => '{{ keycloak.client_secret }}',
    },
);

Plugin('RT::Authen::OAuth2');
Plugin('RT::Extension::CommandByMail');
Set(@MailPlugins, qw(Auth::MailFrom Action::CommandByMail));
Set($OAuthIDP, 'keycloak');
Set($EnableOAuth2, 1);
Set($OAuthCreateNewUser, 0);
Set($OAuthNewUserOptions, {
      Privileged => 0,
  },
);