使用Authelia来实现多站的OIDC登录

identity_providers:
  oidc:
    hmac_secret: rc9uqHMWXf69M9TXrEfa2XoAtbXsbSGMvqWC
    # issuer_private_key 这个字段的内容我直接用docker-compose里面的env来替代，减少yaml中的配置长度和保护机密
    #AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/config/key.pem
    #issuer_private_key:
    access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m
    enable_client_debug_messages: false
    enforce_pkce: public_clients_only
    cors:
      endpoints:
        - authorization
        - token
        - revocation
        - introspection
      #这里允许配置为`*`,代表全部网站
      allowed_origins: "*"
      #  - https://example.com
      allowed_origins_from_client_redirect_uris: false
    clients:
      #如果多个应用，复制下面同样的一大串进行具体配置即可
      - id: grafana
        description: grafana
        secret: GzPji9HrYbLQEX
        sector_identifier: ''
        public: false
        #校验的级别，可以是one_factor等
        authorization_policy: two_factor
        pre_configured_consent_duration: ''
        audience: []
        #可以访问到的用户信息，具体有哪些，可以直接看官方文档的说明
        scopes:
          - openid
          - groups
          - email
          - profile
        #在auth登录成功后需要重定向的接口地址，不同的应用需要根据实际情况配置
        redirect_uris:
          - https://grafana.abc.com/login/generic_oauth
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment
        userinfo_signing_algorithm: none

---
version: '3.3'

services:
  grafana:
    image: grafana/grafana-oss:${grafana_version}
    networks:
      - gateway
    container_name: grafana
    command:
      - 'grafana-server --config /etc/grafana/grafana.ini'
    restart: unless-stopped
    env_file: .env
    volumes:
      - ./grafana.ini:/etc/grafana/grafana.ini
      - /data/grafana:/var/lib/grafana
    healthcheck:
      disable: false
    environment:
      - TZ=Asia/Shanghai
    ports:
      - 4000:3000
networks:
  gateway:
    external: true
...

# The full public facing url you use in browser, used for redirects and emails
# 这个配置为你的grafana地址，需要进行配置
root_url = https://grafana.abc.com
# 如果仅限OAuth仅限登录的话设置为true（建议先设置为false，待修改OIDC的权限配置为admin之后再关闭）
disable_login_form = true
#################################### Generic OAuth ##########################
[auth.generic_oauth]
enabled = true
name = authelia
allow_sign_up = true
client_id = grafana
client_secret = GzPji9HrYbLQEX
scopes = openid profile groups email
empty_scopes = false
auth_url = https://auth.example.com/api/oidc/authorization
token_url = https://auth.example.com/api/oidc/token
api_url = https://auth.example.com/oidc/userinfo
use_pkce = true