# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
version: 1
metadata:
  name: haze-nextcloud-scim
entries:
  - model: authentik_sources_scim.scimsource
    id: scim-source
    identifiers:
      slug: nextcloud-scim
    attrs:
      name: Nextcloud SCIM
      enabled: true

  - model: authentik_core.token
    identifiers:
      identifier: !Format ["ak-source-scim-%s", !KeyOf scim-source]
    attrs:
      key: haze-scim-token
      intent: api
      expiring: false
      user:
        !Find [
          authentik_core.user,
          [username, !Format ["ak-source-scim-%s", !KeyOf scim-source]],
        ]

  # Pushes Authentik's users and groups into Authentik's SCIM source
  - model: authentik_providers_scim.scimprovider
    id: scim-provider
    identifiers:
      name: Nextcloud SCIM
    attrs:
      url: http://authentik:9000/source/scim/nextcloud-scim/v2
      token: haze-scim-token
      exclude_users_service_account: true
      property_mappings:
        - !Find [
            authentik_providers_scim.scimmapping,
            [managed, goauthentik.io/providers/scim/user],
          ]
      property_mappings_group:
        - !Find [
            authentik_providers_scim.scimmapping,
            [managed, goauthentik.io/providers/scim/group],
          ]

  - model: authentik_core.application
    identifiers:
      slug: nextcloud-scim
    attrs:
      name: Nextcloud SCIM
      backchannel_providers:
        - !KeyOf scim-provider
      meta_launch_url: !File /haze/authentik/nextcloud-url
      meta_description: Nextcloud instance provisioned by haze