apiVersion: v1
kind: ConfigMap
metadata:
  name: blueprint-jellyfin-ldap
  namespace: authentik
data:
  jellyfin-ldap.yaml: |
    version: 1
    metadata:
      name: Jellyfin LDAP
    entries:
      - model: authentik_stages_password.passwordstage
        id: ldap-password
        identifiers:
          name: ldap-authentication-password
        attrs:
          backends:
            - authentik.core.auth.InbuiltBackend
            - authentik.core.auth.TokenBackend
      - model: authentik_stages_identification.identificationstage
        id: ldap-identification
        identifiers:
          name: ldap-authentication-identification
        attrs:
          user_fields:
            - username
          password_stage: !KeyOf ldap-password
      - model: authentik_stages_user_login.userloginstage
        id: ldap-login
        identifiers:
          name: ldap-authentication-login
      - model: authentik_flows.flow
        id: ldap-flow
        identifiers:
          slug: ldap-authentication
        attrs:
          designation: authentication
          name: LDAP bind
          title: LDAP bind
      - model: authentik_flows.flowstagebinding
        identifiers:
          order: 10
          stage: !KeyOf ldap-identification
          target: !KeyOf ldap-flow
      - model: authentik_flows.flowstagebinding
        identifiers:
          order: 30
          stage: !KeyOf ldap-login
          target: !KeyOf ldap-flow
      - model: authentik_core.user
        id: ldap-jellyfin
        identifiers:
          username: ldap-jellyfin
        attrs:
          name: Jellyfin LDAP bind
          password: !Env JELLYFIN_LDAP_PASSWORD
      - model: authentik_providers_ldap.ldapprovider
        id: jellyfin-ldap-provider
        identifiers:
          name: jellyfin-ldap
        attrs:
          authorization_flow: !KeyOf ldap-flow
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
          base_dn: dc=ldap,dc=goauthentik,dc=io
          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
          bind_mode: direct
          search_mode: direct
          mfa_support: false # else ";" in a password is read as a TOTP separator
        permissions:
          - permission: authentik_providers_ldap.search_full_directory
            user: !KeyOf ldap-jellyfin
      - model: authentik_core.application
        id: jellyfin-ldap
        identifiers:
          slug: jellyfin-ldap
        attrs:
          name: Jellyfin LDAP
          provider: !KeyOf jellyfin-ldap-provider
          policy_engine_mode: any
      - model: authentik_policies.policybinding
        identifiers:
          order: 0
          target: !KeyOf jellyfin-ldap
        attrs:
          group: !Find [authentik_core.group, [name, admins]]
      - model: authentik_policies.policybinding
        identifiers:
          order: 10
          target: !KeyOf jellyfin-ldap
        attrs:
          user: !KeyOf ldap-jellyfin
      - model: authentik_outposts.outpost
        identifiers:
          name: ldap
        attrs:
          type: ldap
          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
          providers:
            - !KeyOf jellyfin-ldap-provider
          config:
            authentik_host: http://authentik-server.authentik.svc.cluster.local
      - model: authentik_core.user
        identifiers:
          username: whyredfire
        attrs:
          attributes:
            jellyfinUsername: karan
      - model: authentik_core.token
        identifiers:
          identifier: jellyfin-whyredfire
        attrs:
          user: !Find [authentik_core.user, [username, whyredfire]]
          intent: app_password
          key: !Env JELLYFIN_APP_PASSWORD
          expiring: false
          description: Jellyfin