I have been trying to enable authorization using the temporal helm chart with no success so far, the configuration I provide:
server
server:
config:
authorization:
jwtKeyProvider:
keySourceURIs:
- https://login.microsoftonline.com/${tenant_id}/discovery/v2.0/keys
refreshInterval: 1m
permissionsClaimName: roles
authorizer: default
claimMapper: default
additionalEnv:
- name: TEMPORAL_JWT_PERMISSIONS_CLAIM
value: "roles"
- name: TEMPORAL_AUTH_AUTHORIZER
value: "default"
- name: TEMPORAL_AUTH_CLAIM_MAPPER
value: "default"
- name: TEMPORAL_JWT_KEY_SOURCE1
value: "https://login.microsoftonline.com/${tenant_id}/discovery/v2.0/keys"
- name: TEMPORAL_JWT_KEY_REFRESH
value: "1m"
- name: USE_INTERNAL_FRONTEND
value: "true"
Web UI
additionalEnv:
- name: TEMPORAL_AUTH_ENABLED
value: "true"
- name: TEMPORAL_AUTH_PROVIDER_URL
value: "https://login.microsoftonline.com/${tenant_id}/v2.0"
- name: TEMPORAL_AUTH_ISSUER_URL
value: "https://login.microsoftonline.com/${tenant_id}/v2.0"
- name: TEMPORAL_AUTH_CALLBACK_URL
value: "https://$my_url/auth/sso/callback"
- name: TEMPORAL_AUTH_SCOPES
value: 'openid,email,profile'
On the azure side I configure a write access to a namespace for a group.
So far, both web ui and workers return unauthorized without much context.
Would be nice to get some support.