implement the rest of login process incl. cookie redirects and 'next'

1 files changed, 16 insertions, 3 deletions

diff --git a/config.ini b/config.ini
index 633a88c..d09ef3d 100644
--- a/config.ini
+++ b/config.ini
@@ -8,12 +8,16 @@ name = Pleasant SSO
 ;; primary domain where your login page will be
 primary-domain = auth.example.com
 
-;; all domains that need to be visited to set cookies appropriately
+;; additional domains that need to be visited to set cookies appropriately
+;; (primary-domain is implicitly always included so don't put it again here)
 ;; note that for now, it's assumed that the domain one level higher than these
 ;; is the "registrable domain" where the cookies are set to
-;; e.g. for 'auth.example.com', the cookie will get Domain=example.com
-cookie-domains[] = auth.example.com
+;; e.g. for 'auth.example.net', the cookie will get Domain=example.net
 cookie-domains[] = auth.example.net
+cookie-domains[] = auth.example.org
+
+;; additional domains where it's allowed to redirect to (includes subdomains)
+redirect-domains[] = thirdparty.example
 
 ;; location where the source code of the version of the software running on your
 ;; server can be found. so if you make any significant changes to the source
@@ -26,6 +30,7 @@ source-location = https://git.зима.net/winter/pleasant-sso/
 
 ;; what string to put on the front of header names destined for proxies
 ;; e.g. if this is 'X-Login', it will make headers like 'X-Login-User'
+;; e.g. if you want to match authelia, set it to 'Remote'
 header-prefix = X-Login
 
 
@@ -33,6 +38,7 @@ header-prefix = X-Login
 
 ;; what AuthProvider to use - i.e. who to ask for users' information
 ;; ConfigFile -> look in this file, see below
+;; coming soon will be Ldap, etc.
 provider = ConfigFile
 
 ;; how long (in seconds) until a session expires and you have to log in again
@@ -47,5 +53,12 @@ lifetime = 604800
 
 ;; password-hash -> allow password login for user
 ;; password hash should be generated by php function 'password_hash'
+;; groups -> space-separated list of groups to put the user in
+;; name -> display name
+;; email -> email address
+;; none are required but at least one must be present for the user to exist
+winter[name] = winter Sparkles
 winter[password-hash] = "$2y$12$V3dwpbHF5fTx46g9xMflvODNGmr0apltiaDONUSE2skRrslgcRxSS"
+winter[groups] = admin
+
 ;; more options to be added in future!