docker-compose-oidc.yaml

services:
  play:
    environment:
      #OPID_CLIENT_ID: authorization-code-with-pkce-client-id
      #OPID_CLIENT_SECRET: authorization-code-with-pkce-client-secret
      OPID_CLIENT_ID: authorization-code-client-id
      OPID_CLIENT_SECRET: authorization-code-client-secret
      OPID_CLIENT_ISSUER: http://oidc.workadventure.localhost
      OPID_SCOPE: profile openid email tags-scope
      MAP_EDITOR_ALLOWED_USERS: noUserAllowed

  # A mock server to test OpenID connect connectivity
  oidc-server-mock:
    image: ghcr.io/soluto/oidc-server-mock:0.7.0
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      SERVER_OPTIONS_INLINE: |
        {
          "AccessTokenJwtType": "JWT",
          "Discovery": {
            "ShowKeySet": true
          },
          "Authentication": {
            "CookieSameSiteMode": "Lax",
            "CheckSessionCookieSameSiteMode": "Lax"
          }
        }
      LOGIN_OPTIONS_INLINE: |
        {
          "AllowRememberLogin": false
        }
      LOGOUT_OPTIONS_INLINE: |
        {
          "AutomaticRedirectAfterSignOut": true
        }
      API_SCOPES_INLINE: |
        - Name: tags
          UserClaims:
            - tags-scope
      API_RESOURCES_INLINE: |
        - Name: some-app
          Scopes:
            - some-app-scope-1
            - tags-scope
          UserClaims:
            - tags
      USERS_CONFIGURATION_INLINE: |
        [
          {
            "SubjectId":"1",
            "Username":"User1",
            "Password":"pwd",
            "Claims": [
              {
                "Type": "name",
                "Value": "John Doe",
                "ValueType": "string",
              },
              {
                "Type": "email",
                "Value": "john.doe@example.com",
                "ValueType": "string"
              },
              {
                "Type": "tags",
                "Value": "[\"admin\"]",
                "ValueType": "json"
              },
            ]
          },
          {
            "SubjectId":"2",
            "Username":"User2",
            "Password":"pwd",
            "Claims": [
              {
                "Type": "name",
                "Value": "Alice Doe",
                "ValueType": "string",
              },
              {
                "Type": "email",
                "Value": "alice.doe@example.com",
                "ValueType": "string"
              },
              {
                "Type": "tags",
                "Value": "[\"member\"]",
                "ValueType": "json"
              },
            ]
          },
        {
            "SubjectId":"3",
            "Username":"UserMatrix",
            "Password":"pwd",
            "Claims": [
              {
                "Type": "name",
                "Value": "John Doe",
                "ValueType": "string",
              },
              {
                "Type": "email",
                "Value": "john.doe@example.com",
                "ValueType": "string"
              },
              {
                "Type": "tags",
                "Value": "[\"admin\"]",
                "ValueType": "json"
              },
            ]
          },
        ]
      IDENTITY_RESOURCES_INLINE: |
        [
          {
            "Name": "tags-scope",
            "ClaimTypes": ["tags"]
          }
        ]
      CLIENTS_CONFIGURATION_PATH: /tmp/config/clients-config.json
    volumes:
      - ./contrib/oidc-server-mock:/tmp/config:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.oidc.rule=Host(`oidc.workadventure.localhost`)"
      - "traefik.http.routers.oidc.entryPoints=web"
    healthcheck:
      #disable: true
      timeout: 5s

  synapse:
    depends_on:
      oidc-server-mock:
        condition: service_healthy