version: 1
metadata:
  name: nextcloud-saml-setup
entries:
  - model: authentik_providers_saml.samlprovider
    identifiers:
      name: Nextcloud SAML
    attrs:
      authorization_flow:
        !Find [
          authentik_flows.flow,
          [slug, default-provider-authorization-explicit-consent],
        ]
      invalidation_flow:
        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]

      acs_url: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/acs
      audience: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/metadata
      issuer: https://@AUTHENTIK_DOMAIN@
      sp_binding: post
      property_mappings:
        - !Find [
            authentik_core.propertymapping,
            [name, "authentik default SAML Mapping: Name"],
          ]
        - !Find [
            authentik_core.propertymapping,
            [name, "authentik default SAML Mapping: Email"],
          ]
        - !Find [
            authentik_core.propertymapping,
            [name, "authentik default SAML Mapping: Groups"],
          ]
        - !Find [
            authentik_core.propertymapping,
            [name, "authentik default SAML Mapping: Username"],
          ]
        - !Find [
            authentik_core.propertymapping,
            [name, "authentik default SAML Mapping: User ID"],
          ]

      signing_kp:
        !Find [
          authentik_crypto.certificatekeypair,
          [name, "authentik Self-signed Certificate"],
        ]
      sign_assertion: true
      sign_response: false

  - model: authentik_core.application
    identifiers:
      slug: nextcloud
    attrs:
      name: Nextcloud
      provider:
        !Find [authentik_providers_saml.samlprovider, [name, Nextcloud SAML]]
      launch_url: "@NEXTCLOUD_DOMAIN@"
