Tududi: add task tracke application

files/authelia/configuration.template.yml

@@ -732,6 +732,10 @@ access_control:
       subject: "group:admins"
       policy: "two_factor"
 
+    - domain: "bifrost.vakhrushev.me"
+      subject: "group:admins"
+      policy: "two_factor"
+
     - domain: "wanderbase.vakhrushev.me"
       subject: "group:admins"
       policy: "two_factor"
@@ -1343,6 +1347,18 @@ identity_providers:
 
     ## Authorization Policies which can be utilized by clients. The 'policy_name' is an arbitrary value that you pick
     ## which is utilized as the value for the 'authorization_policy' on the client.
+    ## Claims Policies (Authelia 4.39+): по умолчанию Authelia НЕ кладёт email/
+    ## профильные claims в ID Token — только в UserInfo. tududi читает claims
+    ## ТОЛЬКО из ID Token (userinfo не вызывает), поэтому копируем их в id_token
+    ## явно (при условии, что соответствующий scope выдан клиенту).
+    claims_policies:
+      tududi_claims:
+        id_token:
+          - "email"
+          - "email_verified"
+          - "name"
+          - "preferred_username"
+
     authorization_policies:
       outline_policy:
         rules:
@@ -1401,6 +1417,25 @@ identity_providers:
         userinfo_signed_response_alg: "none"
         token_endpoint_auth_method: "client_secret_basic"
 
+      - client_name: "Tududi"
+        client_id: "{{ oidc__tududi__client_id }}"
+        client_secret: "{{ oidc__tududi__client_secret }}"
+        redirect_uris:
+          - "https://tududi.vakhrushev.me/api/oidc/callback/authelia"
+        scopes:
+          - "openid"
+          - "profile"
+          - "email"
+        response_types:
+          - "code"
+        grant_types:
+          - "authorization_code"
+        access_token_signed_response_alg: "none"
+        userinfo_signed_response_alg: "none"
+        token_endpoint_auth_method: "client_secret_basic"
+        authorization_policy: "one_factor"
+        claims_policy: "tududi_claims"
+
       - client_name: "Wakapi"
         client_id: "{{ oidc__wakapi__client_id }}"
         client_secret: "{{ oidc__wakapi__client_secret }}"